15779 Commits (632e4bd35c1ede814ba4efa77ea74f4b5b2ec378)

 

All Branches   

Search

Author	SHA1	Message	Date
trujillo-adam	632e4bd35c	applied additional feedback	3 years ago
trujillo-adam	32f1463901	updated server and client example yamls in usage section	3 years ago
trujillo-adam	0808e27bd4	removed 'flat network' requirements	3 years ago
trujillo-adam	e4d89b4214	fixed typo and added link from partition exports to admin partitions section	3 years ago
trujillo-adam	96535cb8b7	fixed more bad links	3 years ago
trujillo-adam	6b8225c6f1	fixed bad links	3 years ago
trujillo-adam	e2ac4c8a30	added link to agent configuration from partition exports in usage section	3 years ago
trujillo-adam	756e65cbcb	applied freddy's feedback	3 years ago
trujillo-adam	91e44f488d	Adding partition exports configuraiton entry details, upstream config, acl impact	3 years ago
trujillo-adam	caf850e135	first commit for cross-partition support - partition exports section	3 years ago
mrspanishviking	b8e11507b1	Merge pull request #11543 from hashicorp/envoy-token ... docs: added more information to help endusers with proxies and ACL	3 years ago
mrspanishviking	f1b4a10c83	Update website/content/docs/connect/proxies/integrate.mdx ... Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Dan Upton	50329bf5f6	changelog: entry for enterprise licensing bug fix (#11551)	3 years ago
John Cowen	6557f52962	ui: Bump our browser support (#11505) ... Bumps our browser support to a "rough ~2 years back" approach.	3 years ago
John Cowen	66f1dd9425	ui: [Port] Ensure the tokens default nspace (and partition) is passed thru to the auth endpoint (#11490) ... Most HTTP API calls will use the default namespace of the calling token to additionally filter/select the data used for the response if one is not specified by the frontend. The internal permissions/authorize endpoint does not do this (you can ask for permissions from different namespaces in on request). Therefore this PR adds the tokens default namespace in the frontend only to our calls to the authorize endpoint. I tried to do it in a place that made it feel like it's getting added in the backend, i.e. in a place which was least likely to ever require changing or thinking about. Note: We are probably going to change this internal endpoint to also inspect the tokens default namespace on the backend. At which point we can revert this commit/PR. * Add the same support for the tokens default partition	3 years ago
Kenia	37de276350	ui: Add Consul API Gateway as an external source (#11371)	3 years ago
Freddy	3e486cae86	Merge pull request #11546 from hashicorp/ui/bug/revert-11328 ... ui: Revert #11328 allow-${}-style-interpolation due, to browser support	3 years ago
mrspanishviking	34e1c2b8d2	Merge pull request #11542 from hashicorp/vault-ca ... docs: added link to the Learn tutorial in Vault CA integration page	3 years ago
mrspanishviking	42ab9e8aa4	Update website/content/docs/connect/ca/vault.mdx ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
David Yu	f1d1c12ad5	docs: provide more example CLI commands and reference Vault (#11528) ... * docs: provide more example CLI commands and reference Vault * Extra formatting * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * adding more detail around gossip encryption rotation precautions * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	3 years ago
99	0c5fdb167d	Add changelog entry (#11549)	3 years ago
Freddy	09ef65d053	Merge pull request #11545 from hashicorp/spiffe-assertion ... Use ClusterID to check for readiness	3 years ago
freddygv	d6c26ea598	Bump retry time for cross-DC RPC ... The secondary DC now takes longer to populate the MGW snapshot because it needs to wait for the secondary CA to be initialized before it can receive roots and generate xDS config. Previously MGWs could receive empty roots before the CA was initialized. This wasn't necessarily a problem since the cluster ID in the trust domain isn't verified.	3 years ago
John Cowen	537c4f32f7	Revert "Merge pull request #11328 from radiantly/ui/feature/allow-${}-style-interpolation" ... This reverts commit cd55c0cda3, reversing changes made to 14af8cb7a9.	3 years ago
freddygv	400697507b	Move assertion to after config fetch	3 years ago
freddygv	da5bcc574e	Use ClusterID to check for readiness ... The TrustDomain is populated from the Host() method which includes the hard-coded "consul" domain. This means that despite having an empty cluster ID, the TrustDomain won't be empty.	3 years ago
Freddy	aca0576cd1	Merge pull request #11541 from hashicorp/secondary-exports ... OSS Backport: Prevent writing partition-exports entries to secondary DCs	3 years ago
trujillo-adam	17ccead352	Merge pull request #11487 from hashicorp/docs/admin-partitions-feedback-acl-policies-redux ... changed 'segments' in this page to 'resource labels' to disambiguate from 'network segments updated the code snippets to use CodeBlock component and to include JSON	3 years ago
Karl Cardenas	50ff9e8a6e	docs: added more information to help endusers with proxies and ACL tokens	3 years ago
Karl Cardenas	5644edae5c	docs: added link to the Learn tutorial in Vault CA integration page	3 years ago
Nitya Dhanushkodi	139c4eb844	command/redirect_traffic: Redirect DNS requests to Consul if -consul-dns-ip is passed in (#11480) ... * command/redirect_traffic: add rules to redirect DNS to Consul. Currently uses a hack to get the consul dns service ip, and this hack only works when the service is deployed in the same namespace as consul. * command/redirect_traffic: redirect DNS to Consul when -consul-dns-ip is passed in * Add unit tests to Consul DNS IP table redirect rules Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>	3 years ago
John Cowen	aeaa0a6c96	ui: Temporarily force all UI capabilities (#11520) ... Temporarily revert to pre-1.10 UI functionality by overwriting frontend permissions. These are used to hide certain UI elements, but they are still enforced on the backend. This temporary measure should be removed again once https://github.com/hashicorp/consul/issues/11098 has been resolved	3 years ago
trujillo-adam	9333fad1e3	added json versions for all hcl examples	3 years ago
freddygv	a17f20be04	Add changelog entry	3 years ago
freddygv	6976044bc4	Prevent replicating partition-exports	3 years ago
freddygv	5c121d7a48	handle error scenario of empty local DC	3 years ago
freddygv	af29cda415	Restrict DC for partition-exports writes ... There are two restrictions: - Writes from the primary DC which explicitly target a secondary DC. - Writes to a secondary DC that do not explicitly target the primary DC. The first restriction is because the config entry is not supported in secondary datacenters. The second restriction is to prevent the scenario where a user writes the config entry to a secondary DC, the write gets forwarded to the primary, but then the config entry does not apply in the secondary. This makes the scope more explicit.	3 years ago
Freddy	00b5b0a0a2	Update filter chain creation for sidecar/ingress listeners (#11245) ... The duo of `makeUpstreamFilterChainForDiscoveryChain` and `makeListenerForDiscoveryChain` were really hard to reason about, and led to concealing a bug in their branching logic. There were several issues here: - They tried to accomplish too much: determining filter name, cluster name, and whether RDS should be used. - They embedded logic to handle significantly different kinds of upstream listeners (passthrough, prepared query, typical services, and catch-all) - They needed to coalesce different data sources (Upstream and CompiledDiscoveryChain) Rather than handling all of those tasks inside of these functions, this PR pulls out the RDS/clusterName/filterName logic. This refactor also fixed a bug with the handling of [UpstreamDefaults](https://www.consul.io/docs/connect/config-entries/service-defaults#defaults). These defaults get stored as UpstreamConfig in the proxy snapshot with a DestinationName of "*", since they apply to all upstreams. However, this wildcard destination name must not be used when creating the name of the associated upstream cluster. The coalescing logic in the original functions here was in some situations creating clusters with a `*.` prefix, which is not a valid destination.	3 years ago
mrspanishviking	6880551c21	Merge pull request #11521 from hashicorp/broken-link ... docs: removed broken link to Ambassador	3 years ago
99	80edd040e7	Merge pull request #11485 from hashicorp/add_rpm_signing ... Add rpm signing workflow	3 years ago
John Cowen	1515c3e667	ui: Filter global intentions list by selected partition (#11475) ... * ui: Filter global intentions list by namespace and partition Filters global intention listing by the current partition rather than trying to use a wildcard.	3 years ago
Kyle Havlovitz	6c0bd0550f	Merge pull request #11461 from deblasis/feature/empty_client_addr_warning ... config: warn the user if client_addr is empty	3 years ago
Mark Anderson	adb7510a7e	Fixup changelog filename (#11501) ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Daniel Upton	50a1f20ff9	xds: prefer fed state gateway definitions if they're fresher (#11522) ... Fixes an issue described in #10132, where if two DCs are WAN federated over mesh gateways, and the gateway in the non-primary DC is terminated and receives a new IP address (as is commonly the case when running them on ephemeral compute instances) the primary DC is unable to re-establish its connection until the agent running on its own gateway is restarted. This was happening because we always preferred gateways discovered by the `Internal.ServiceDump` RPC (which would fail because there's no way to dial the remote DC) over those discovered in the federation state, which is replicated as long as the primary DC's gateway is reachable.	3 years ago
Karl Cardenas	5522610615	docs: added link to Ambassador tutorial in k8s section	3 years ago
99	8fb999b2e0	Update .release/ci.hcl ... Co-authored-by: Scott Macfarlane <36851+smacfarlane@users.noreply.github.com>	3 years ago
Freddy	7d95d90fce	Merge pull request #11514 from hashicorp/dnephin/ca-fix-secondary-init ... ca: properly handle the case where the secondary initializes after the primary	3 years ago
freddygv	44748bf234	Add changelog entry	3 years ago
freddygv	cc5a7ed36c	Avoid returning empty roots with uninitialized CA ... Currently getCARoots could return an empty object with an empty trust domain before the CA is initialized. This commit returns an error while there is no CA config or no trust domain. There could be a CA config and no trust domain because the CA config can be created in InitializeCA before initialization succeeds.	3 years ago
Dhia Ayachi	7916268c40	refactor session state store tables to use the new index pattern (#11525) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused func `prefixIndexFromServiceNameAsString` * fix test error check * remove unused operations_ent.go and operations_oss.go func * remove unused const Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago