92 Commits (6928ea090f503755da59755aecd5e3cf349d4ba8)

Author	SHA1	Message	Date
R.B. Boyer	d0f74cd1e8	connect: fix bug in preventing some namespaced config entry modifications (#8601) ... Whenever an upsert/deletion of a config entry happens, within the open state store transaction we speculatively test compile all discovery chains that may be affected by the pending modification to verify that the write would not create an erroneous scenario (such as splitting traffic to a subset that did not exist). If a single discovery chain evaluation references two config entries with the same kind and name in different namespaces then sometimes the upsert/deletion would be falsely rejected. It does not appear as though this bug would've let invalid writes through to the state store so the correction does not require a cleanup phase.	4 years ago
Freddy	10d6e9c458	Split up unused key validation for oss/ent (#8189) ... Split up unused key validation in config entry decode for oss/ent. This is needed so that we can return an informative error in OSS if namespaces are provided.	4 years ago
freddygv	c791fbc79c	Update namespaces subject-verb agreement	5 years ago
freddygv	044d027ff8	Remove break	5 years ago
freddygv	70810b0602	Let users know namespaces are ent only in config entry decode	5 years ago
Daniel Nephin	75cbbe2702	config: add HookWeakDecodeFromSlice ... Currently opaque config blocks (config entries, and CA provider config) are modified by PatchSliceOfMaps, making it impossible for these opaque config sections to contain slices of maps. In order to fix this problem, any lazy-decoding of these blocks needs to support weak decoding of []map[string]interface{} to a struct type before PatchSliceOfMaps is replaces. This is necessary because these config blobs are persisted, and during an upgrade an older version of Consul could read one of the new configuration values, which would cause an error. To support the upgrade path, this commit first introduces the new hooks for weak decoding of []map[string]interface{} and uses them only in the lazy-decode paths. That way, in a future release, new style configuration will be supported by the older version of Consul. This decode hook has a number of advantages: 1. It no longer panics. It allows mapstructure to report the error 2. It no longer requires the user to declare which fields are slices of structs. It can deduce that information from the 'to' value. 3. It will make it possible to preserve opaque configuration, allowing for structured opaque config.	5 years ago
Daniel Nephin	6a2d7d77c0	config: use the new HookTranslateKeys instead of lib.TranslateKeys ... With the exception of CA provider config, which will be migrated at some later time.	5 years ago
Daniel Nephin	8ced4300c8	Add alias struct tags for new decode hook	5 years ago
Chris Piraino	b73a13fc9e	Remove service_subset field from ingress config entry ... We decided that this was not a useful MVP feature, and just added unnecessary complexity	5 years ago
Freddy	aae14b3951	Add decode rules for Expose cfg in service-defaults (#7611)	5 years ago
Freddy	90576060bc	Add config entry for terminating gateways (#7545) ... This config entry will be used to configure terminating gateways. It accepts the name of the gateway and a list of services the gateway will represent. For each service users will be able to specify: its name, namespace, and additional options for TLS origination. Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Kyle Havlovitz	c911174327	Add config entry/state for Ingress Gateways (#7483) ... * Add Ingress gateway config entry and other relevant structs * Add api package tests for ingress gateways * Embed EnterpriseMeta into ingress service struct * Add namespace fields to api module and test consul config write decoding * Don't require a port for ingress gateways * Add snakeJSON and camelJSON cases in command test * Run Normalize on service's ent metadata Sadly cannot think of a way to test this in OSS. * Every protocol requires at least 1 service * Validate ingress protocols * Update agent/structs/config_entry_gateways.go Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Matt Keeler	e231d62bc9	Make the config entry and leaf cert cache types ns aware (#7256)	5 years ago
R.B. Boyer	8c596953b0	agent: ensure that we always use the same settings for msgpack (#7245) ... We set RawToString=true so that []uint8 => string when decoding an interface{}. We set the MapType so that map[interface{}]interface{} decodes to map[string]interface{}. Add tests to ensure that this doesn't break existing usages. Fixes #7223	5 years ago
Matt Keeler	c09693e545	Updates to Config Entries and Connect for Namespaces (#7116)	5 years ago
Matt Keeler	5934f803bf	Sync of OSS changes to support namespaces (#6909)	5 years ago
Matt Keeler	973341a592	ACL Authorizer overhaul (#6620) ... * ACL Authorizer overhaul To account for upcoming features every Authorization function can now take an extra *acl.EnterpriseAuthorizerContext. These are unused in OSS and will always be nil. Additionally the acl package has received some thorough refactoring to enable all of the extra Consul Enterprise specific authorizations including moving sentinel enforcement into the stubbed structs. The Authorizer funcs now return an acl.EnforcementDecision instead of a boolean. This improves the overall interface as it makes multiple Authorizers easily chainable as they now indicate whether they had an authoritative decision or should use some other defaults. A ChainedAuthorizer was added to handle this Authorizer enforcement chain and will never itself return a non-authoritative decision. * Include stub for extra enterprise rules in the global management policy * Allow for an upgrade of the global-management policy	5 years ago
Freddy	fdd10dd8b8	Expose HTTP-based paths through Connect proxy (#6446) ... Fixes: #5396 This PR adds a proxy configuration stanza called expose. These flags register listeners in Connect sidecar proxies to allow requests to specific HTTP paths from outside of the node. This allows services to protect themselves by only listening on the loopback interface, while still accepting traffic from non Connect-enabled services. Under expose there is a boolean checks flag that would automatically expose all registered HTTP and gRPC check paths. This stanza also accepts a paths list to expose individual paths. The primary use case for this functionality would be to expose paths for third parties like Prometheus or the kubelet. Listeners for requests to exposed paths are be configured dynamically at run time. Any time a proxy, or check can be registered, a listener can also be created. In this initial implementation requests to these paths are not authenticated/encrypted.	5 years ago
R.B. Boyer	ae79cdab1b	connect: introduce ExternalSNI field on service-defaults (#6324) ... Compiling this will set an optional SNI field on each DiscoveryTarget. When set this value should be used for TLS connections to the instances of the target. If not set the default should be used. Setting ExternalSNI will disable mesh gateway use for that target. It also disables several service-resolver features that do not make sense for an external service.	5 years ago
R.B. Boyer	1a485011d0	connect: updating a service-defaults config entry should leave an unset protocol alone (#6342) ... If the entry is updated for reasons other than protocol it is surprising that the value is explicitly persisted as 'tcp' rather than leaving it empty and letting it fall back dynamically on the proxy-defaults value.	5 years ago
R.B. Boyer	3975cb89bf	agent: blocking central config RPCs iterations should not interfere with each other (#6316)	5 years ago
R.B. Boyer	c395affc93	connect: expose an API endpoint to compile the discovery chain (#6248) ... In addition to exposing compilation over the API cleaned up the structures that would be exchanged to be cleaner and easier to support and understand. Also removed ability to configure the envoy OverprovisioningFactor.	5 years ago
R.B. Boyer	67a36e3452	handle structs.ConfigEntry decoding similarly to api.ConfigEntry decoding (#6106) ... Both 'consul config write' and server bootstrap config entries take a decoding detour through mapstructure on the way from HCL to an actual struct. They both may take in snake_case or CamelCase (for consistency) so need very similar handling. Unfortunately since they are operating on mirror universes of structs (api.* vs structs.*) the code cannot be identitical, so try to share the kind-configuration and duplicate the rest for now.	5 years ago
Matt Keeler	3b6d5e382a	Implement caching for config entry lists ... Update agent/cache-types/config_entry.go Co-Authored-By: R.B. Boyer <public@richardboyer.net>	5 years ago
Matt Keeler	8d953f5840	Implement Mesh Gateways ... This includes both ingress and egress functionality.	5 years ago
R.B. Boyer	2ad516aeaf	do some initial config entry graph validation during writes (#6047)	5 years ago
R.B. Boyer	ceef44bbc9	adding new config entries for L7 discovery chain (unused) (#5987)	6 years ago
Matt Keeler	42d32db817	Fix ConfigEntryResponse binary marshaller and ensure we watch the chan in ConfigEntry.Get even when no entry exists. (#5773)	6 years ago
Paul Banks	8f5b16ebaf	Fix uint8 conversion issues for service config response maps.	6 years ago
Paul Banks	0cfb6051ea	Add integration test for central config; fix central config WIP (#5752) ... * Add integration test for central config; fix central config WIP * Add integration test for central config; fix central config WIP * Set proxy protocol correctly and begin adding upstream support * Add upstreams to service config cache key and start new notify watcher if they change. This doesn't update the tests to pass though. * Fix some merging logic get things working manually with a hack (TODO fix properly) * Simplification to not allow enabling sidecars centrally - it makes no sense without upstreams anyway * Test compile again and obvious ones pass. Lots of failures locally not debugged yet but may be flakes. Pushing up to see what CI does * Fix up service manageer and API test failures * Remove the enable command since it no longer makes much sense without being able to turn on sidecar proxies centrally * Remove version.go hack - will make integration test fail until release * Remove unused code from commands and upstream merge * Re-bump version to 1.5.0	6 years ago
Matt Keeler	d0f410cd84	Make a few config entry endpoints return 404s and allow for snake_case and lowercase key names. (#5748)	6 years ago
Kyle Havlovitz	aba54cec55	Add HTTP endpoints for config entry management (#5718)	6 years ago
Kyle Havlovitz	7c25869e67	Add the service registration manager to the agent	6 years ago
Kyle Havlovitz	fed7595d45	Rename config entry ACL methods	6 years ago
Kyle Havlovitz	690e9dd2c0	Move the ACL logic into the ConfigEntry interface	6 years ago
Kyle Havlovitz	f2ed482680	Add RPC endpoints for config entry operations	6 years ago
Kyle Havlovitz	a2fa9a0019	Cleaned up some error handling/comments around config entries	6 years ago
Kyle Havlovitz	d16be2e269	Encode config entry FSM messages in a generic type	6 years ago
Kyle Havlovitz	f6df5c9b3b	Clean up service config state store methods	6 years ago
Kyle Havlovitz	e199c37ee4	Add some basic normalize/validation logic for config entries	6 years ago
Kyle Havlovitz	d92577c16b	Fix fsm serialization and add snapshot/restore	6 years ago
Kyle Havlovitz	17aa6a5a34	Fill out state store/FSM functions and add tests	6 years ago