consul

Commit Graph

Author	SHA1	Message	Date
John Murret	a7fbd00865	NET-5073 - ProxyConfiguration: implement various connection options (#19187 ) * NET-5073 - ProxyConfiguration: implement various connection options * PR feedback - LocalConnection and InboundConnection do not affect exposed routes. configure L7 route destinations. fix connection proto sequence numbers. * add timeout to L7 Route Destinations	1 year ago
Iryna Shustava	e94d6ceca6	mesh: add validation hook to proxy configuration (#19186 )	1 year ago
Ashwin Venkatesh	3d1a606c3b	Clone proto into deepcopy correctly (#19204 )	1 year ago
Ashwin Venkatesh	c2a0d4f9ca	Create DeepCopy() and Json Marshal/Unmarshal for proto-public (#19015 ) * Override Marshal/UnmarshalJSON for proto-public types * Generate Deepcopy() for proto-public types for Kubernetes CRDs.	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185 ) * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	54a12ab3c9	mesh: sidecar proxy controller improvements (#19083 ) This change builds on #19043 and #19067 and updates the sidecar controller to use those computed resources. This achieves several benefits: * The cache is now simplified which helps us solve for previous bugs (such as multiple Upstreams/Destinations targeting the same service would overwrite each other) * We no longer need proxy config cache * We no longer need to do merging of proxy configs as part of the controller logic * Controller watches are simplified because we no longer need to have complex mapping using cache and can instead use the simple ReplaceType mapper. It also makes several other improvements/refactors: * Unifies all caches into one. This is because originally the caches were more independent, however, now that they need to interact with each other it made sense to unify them where sidecar proxy controller uses one cache with 3 bimappers * Unifies cache and mappers. Mapper already needed all caches anyway and so it made sense to make the cache do the mapping also now that the cache is unified. * Gets rid of service endpoints watches. This was needed to get updates in a case when service's identities have changed and we need to update proxy state template's spiffe IDs for those destinations. This will however generate a lot of reconcile requests for this controller as service endpoints objects can change a lot because they contain workload's health status. This is solved by adding a status to the service object tracking "bound identities" and have service endpoints controller update it. Having service's status updated allows us to get updates in the sidecar proxy controller because it's already watching service objects * Add a watch for workloads. We need it so that we get updates if workload's ports change. This also ensures that we update cached identities in case workload's identity changes.	1 year ago
Iryna Shustava	ad06c96456	mesh: add computed destinations with a controller that computes them (#19067 ) This commit adds a new type ComputedDestinations that will contain all destinations from any Destinations resources and will be name-aligned with a workload. This also adds an explicit-destinations controller that computes these resources. This is needed to simplify the tracking we need to do currently in the sidecar-proxy controller and makes it easier to query all explicit destinations that apply to a workload.	1 year ago
Iryna Shustava	60b75a55f7	mesh: implement exposed paths (#19044 ) Implement exposed paths listeners in the sidecar proxy controller.	1 year ago
Iryna Shustava	c35df12c95	mesh: Add ComputedProxyConfiguration and a controller that computes it. (#19043 ) * Introduce a new type `ComputedProxyConfiguration` and add a controller for it. This is needed for two reasons. The first one is that external integrations like kubernetes may need to read the fully computed and sorted proxy configuration per workload. The second reasons is that it makes sidecar-proxy controller logic quite a bit simpler as it no longer needs to do this. * Generalize workload selection mapper and fix a bug where it would delete IDs from the tree if only one is left after a removal is done.	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028 ) Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
Iryna Shustava	3ea6afb4d4	mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995 )	1 year ago
R.B. Boyer	ca7533850c	mesh: update various protobuf comments for mesh types (#18993 )	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935 )	1 year ago
R.B. Boyer	9e48607893	mesh: compute more of the xRoute features into ComputedRoutes (#18980 ) Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work: - DestinationPolicy defaults - more timeouts - load balancer policy - request/response header mutations - urlrewrite - GRPCRoute matches	1 year ago
R.B. Boyer	11d6b0df45	mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965 ) xRoute resource types contain a slice of parentRefs to services that they manipulate traffic for. All xRoutes that have a parentRef to given Service will be merged together to generate a ComputedRoutes resource name-aligned with that Service. This means that a write of an xRoute with 2 parent ref pointers will cause at most 2 reconciles for ComputedRoutes. If that xRoute's list of parentRefs were ever to be reduced, or otherwise lose an item, that subsequent map event will only emit events for the current set of refs. The removed ref will not cause the generated ComputedRoutes related to that service to be re-reconciled to omit the influence of that xRoute. To combat this, we will store on the ComputedRoutes resource a BoundResources []*pbresource.Reference field with references to all resources that were used to influence the generated output. When the routes controller reconciles, it will use a bimapper to index this influence, and the dependency mappers for the xRoutes will look themselves up in that index to discover additional (former) ComputedRoutes that need to be notified as well.	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930 )	1 year ago

16 Commits (645f1c1a98be3cbde741491a11fc149f208f6925)