4019 Commits (6eea2f2d48ec8f759ad6605c50531c6e092a2852)

Author	SHA1	Message	Date
Kyle Havlovitz	9dcaf0539c	Merge pull request #11798 from hashicorp/vip-goroutine-check ... leader: move the virtual IP version check into a goroutine	3 years ago
Kyle Havlovitz	018693b6ee	acl: use wildcard partition in metrics proxy ui endpoint	3 years ago
Kyle Havlovitz	80a4489844	state: fix freed VIP table id index	3 years ago
Kyle Havlovitz	ecbd3eb2a6	Exit before starting the vip check routine if possible	3 years ago
Daniel Nephin	0a9cb62859	testing: Deprecate functions for creating a server. ... These helper functions actually end up hiding important setup details that should be visible from the test case. We already have a convenient way of setting this config when calling newTestServerWithConfig.	3 years ago
Daniel Nephin	c9a992f5e8	testing: remove old config.Build version ... DefaultConfig already sets the version to version.Version, so by removing this our tests will run with the version that matches the code.	3 years ago
Kyle Havlovitz	04ef1c3fa0	leader: move the virtual IP version check into a goroutine	3 years ago
FFMMM	74eb257b1c	[sync ent] increase segment max limit to 4*64, make configurable (#1424) (#11795) ... * commit b6eb27563e747a78b7647d2b5da405e46364cc46 Author: FFMMM <FFMMM@users.noreply.github.com> Date: Thu Dec 9 13:53:44 2021 -0800 increase segment max limit to 4*64, make configurable (#1424) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * fix: rename ent changelog file Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Daniel Nephin	f9647ece05	Merge pull request #11780 from hashicorp/dnephin/ca-test-vault-in-secondary ... ca: improve test coverage for RenewIntermediate	3 years ago
R.B. Boyer	bb75e63eb4	agent: ensure service maintenance checks for matching partitions ahead of other errors (#11788) ... This matches behavior in most other agent api endpoints.	3 years ago
Daniel Nephin	4116a143e0	fix misleading errors on vault shutdown	3 years ago
Daniel Nephin	968aeff1bb	ca: prune some unnecessary lookups in the tests	3 years ago
Daniel Nephin	305655a8b1	ca: remove duplicate WaitFor function	3 years ago
Daniel Nephin	1dec6bb815	ca: fix flakes in RenewIntermediate tests ... I suspect one problem was that we set structs.IntermediateCertRenewInterval to 1ms, which meant that in some cases the intermediate could renew before we stored the original value. Another problem was that the 'wait for intermediate' loop was calling the provider.ActiveIntermediate, but the comparison needs to use the RPC endpoint to accurately represent a user request. So changing the 'wait for' to use the state store ensures we don't race. Also moves the patching into a separate function. Removes the addition of ca.CertificateTimeDriftBuffer as part of calculating halfTime. This was added in a previous commit to attempt to fix the flake, but it did not appear to fix the problem. Adding the time here was making the tests fail when using the shared patch function. It's not clear to me why, but there's no reason we should be including this time in the halfTime calculation.	3 years ago
Daniel Nephin	2e4e8bd791	ca: improve RenewIntermediate tests ... Use the new verifyLearfCert to show the cert verifies with intermediates from both sources. This required using the RPC interface so that the leaf pem was constructed correctly. Add IndexedCARoots.Active since that is a common operation we see in a few places.	3 years ago
Daniel Nephin	a4ba1f348d	ca: add a test for Vault in secondary DC	3 years ago
Daniel Nephin	a5d9b1d322	ca: Add CARoots.Active method ... Which will be used in the next commit.	3 years ago
R.B. Boyer	5f5720837b	acl: ensure that the agent recovery token is properly partitioned (#11782)	3 years ago
Daniel Nephin	f72e285fe8	Merge pull request #11721 from hashicorp/dnephin/ca-export-fsm-operation ... ca: use the real FSM operation in tests	3 years ago
Daniel Nephin	214dcf8d0d	ca: use the real FSM operation in tests ... Previously we had a couple copies that reproduced the FSM operation. These copies introduce risk that the test does not accurately match production. This PR removes the test versions of the FSM operation, and exports the real production FSM operation so that it can be used in tests. The consul provider tests did need to change because of this. Previously we would return a hardcoded value of 2, but in production this value is always incremented.	3 years ago
R.B. Boyer	592ac8f96a	test: test server should auto cleanup (#11779)	3 years ago
Evan Culver	7a365fa0da	rpc: Unset partition before forwarding to remote datacenter (#11758)	3 years ago
Daniel Nephin	dccd3f5806	Merge remote-tracking branch 'origin/main' into serve-panic-recovery	3 years ago
Dan Upton	7efab269c0	Rename `Master` and `AgentMaster` fields in config protobuf (#11764)	3 years ago
Chris S. Kim	f8f8580ab2	Godocs updates for catalog endpoints (#11716)	3 years ago
Mathew Estafanous	0a9621ec7a	Transition all endpoint tests in agent_endpoint_test.go to go through ServeHTTP (#11499)	3 years ago
Dan Upton	205ce9a69d	Remove references to "master" ACL tokens in tests (#11751)	3 years ago
Dan Upton	7fe81171d9	Rename `ACLMasterToken` => `ACLInitialManagementToken` (#11746)	3 years ago
Dan Upton	3a91815169	agent/token: rename `agent_master` to `agent_recovery` (internally) (#11744)	3 years ago
R.B. Boyer	9315a9812f	return the max	3 years ago
freddygv	60fe5f75bb	Remove support for failover to partition ... Failing over to a partition is more siimilar to failing over to another datacenter than it is to failing over to a namespace. In a future release we should update how localities for failover are specified. We should be able to accept a list of localities which can include both partition and datacenter.	3 years ago
freddygv	5c1f7aa372	Allow cross-partition references in disco chain ... * Add partition fields to targets like service route destinations * Update validation to prevent cross-DC + cross-partition references * Handle partitions when reading config entries for disco chain * Encode partition in compiled targets	3 years ago
R.B. Boyer	b1605639fc	light refactors to support making partitions and serf-based wan federation are mutually exclusive (#11755)	3 years ago
R.B. Boyer	e20e6348dd	areas: make the gRPC server tracker network area aware (#11748) ... Fixes a bug whereby servers present in multiple network areas would be properly segmented in the Router, but not in the gRPC mirror. This would lead servers in the current datacenter leaving from a network area (possibly during the network area's removal) from deleting their own records that still exist in the standard WAN area. The gRPC client stack uses the gRPC server tracker to execute all RPCs, even those targeting members of the current datacenter (which is unlike the net/rpc stack which has a bypass mechanism). This would manifest as a gRPC method call never opening a socket because it would block forever waiting for the current datacenter's pool of servers to be non-empty.	3 years ago
Freddy	a725f06c83	Merge pull request #11739 from hashicorp/ap/exports-rename	3 years ago
freddygv	e91509383f	Clean up additional refs to partition exports	3 years ago
freddygv	ed6076db26	Rename partition-exports to exported-services ... Using a name less tied to partitions gives us more flexibility to use this config entry in OSS for exports between datacenters/meshes.	3 years ago
freddygv	f5b25401b3	Update intention topology to use new table	3 years ago
freddygv	55970c6ccd	Avoid updating default decision from wildcard ixn ... Given that we do not allow wildcard partitions in intentions, no one ixn can override the DefaultAllow setting. Only the default ACL policy applies across all partitions.	3 years ago
freddygv	497aab669f	Add a new table to query service names by kind ... This table purposefully does not index by partition/namespace. It's a global view into all service names. This table is intended to replace the current serviceListTxn watch in intentionTopologyTxn. For cross-partition transparent proxying we need to be able to calculate upstreams from intentions in any partition. This means that the existing serviceListTxn function is insufficient since it's scoped to a partition. Moving away from that function is also beneficial because it watches the main "services" table, so watchers will wake up when any instance is registered or deregistered.	3 years ago
freddygv	e7a7042c69	Update listener generation to account for consul VIP	3 years ago
Freddy	f032d6ef05	Merge pull request #11680 from hashicorp/ap/partition-exports-oss	3 years ago
Dan Upton	3b9dfca88d	internal: support `ResultsFilteredByACLs` flag/header (#11643)	3 years ago
Dan Upton	c8204330ed	query: support `ResultsFilteredByACLs` in query list endpoint (#11620)	3 years ago
Dhia Ayachi	ce326b6074	port oss changes (#11736)	3 years ago
Freddy	e246defb6c	Merge pull request #11720 from hashicorp/bbolt	3 years ago
Dan Upton	047aa2ffb0	fedstate: support `ResultsFilteredByACLs` in `ListMeshGateways` endpoint (#11644)	3 years ago
Dan Upton	361d9c2862	catalog: support `ResultsFilteredByACLs` flag/header (#11594)	3 years ago
Dan Upton	4c0956c03a	coordinate: support `ResultsFilteredByACLs` flag/header (#11617)	3 years ago
Dan Upton	bf1e2ca551	sessions: support `ResultsFilteredByACLs` flag/header (#11606)	3 years ago
Dan Upton	d92f0d84c6	txn: support `ResultsFilteredByACLs` flag in `Read` endpoint (#11632)	3 years ago
Dan Upton	547aa219ea	agent: support `X-Consul-Results-Filtered-By-ACLs` header in agent-local endpoints (#11610)	3 years ago
Dhia Ayachi	86159c6ed8	sessions partitioning tests (#11734) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused operations_ent.go and operations_oss.go func * remove unused const * convert `IndexID` of `session_checks` table * convert `indexSession` of `session_checks` table * convert `indexNodeCheck` of `session_checks` table * partition `indexID` and `indexSession` of `tableSessionChecks` * fix oss linter * fix review comments * remove partition for Checks as it's always use the session partition * fix tests * fix tests * do not namespace nodeChecks index Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dan Upton	c314be2ff9	intention: support `ResultsFilteredByACLs` flag/header (#11612)	3 years ago
Mark Anderson	a89ffba2d4	Cross port of ent #1383 (#11726) ... Cross port of ent #1383 "Reject non-default datacenter when making partitioned ACLs" On the OSS side this is a minor refactor to add some more checks that are only applicable to enterprise code. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Dan Upton	599a4d6619	config: support `ResultsFilteredByACLs` in list/list all endpoints (#11621)	3 years ago
Dan Upton	c4c68915c9	event: support `X-Consul-Results-Filtered-By-ACLs` header in list (#11616)	3 years ago
Dan Upton	474ef7cc1f	kv: support `ResultsFilteredByACLs` in list/list keys (#11593)	3 years ago
Dan Upton	cf1bd585f6	health: support `ResultsFilteredByACLs` flag/header (#11602)	3 years ago
Dan Upton	1e47e3c82b	Groundwork for exposing when queries are filtered by ACLs (#11569)	3 years ago
Kyle Havlovitz	0546bbe08a	dns: add endpoint for querying service virtual IPs	3 years ago
Kyle Havlovitz	6f34a4f777	Merge pull request #11724 from hashicorp/service-virtual-ips ... oss: add virtual IP generation for connect services	3 years ago
Kyle Havlovitz	4f2cfee4b0	consul: add virtual IP generation for connect services	3 years ago
R.B. Boyer	c46f9f9f31	agent: add variation of force-leave that exclusively works on the WAN (#11722) ... Fixes #6548	3 years ago
Matt Keeler	c7a94843ee	Emit raft-boltdb metrics	3 years ago
Daniel Nephin	e47cecc653	config: add NoFreelistSync option ... # Conflicts: # agent/config/testdata/TestRuntimeConfig_Sanitize-enterprise.golden # agent/consul/server.go	3 years ago
Matt Keeler	42a5635bc3	Use raft-boltdb/v2	3 years ago
Daniel Nephin	17a2d14d49	ca: set the correct SigningKeyID after config update with Vault provider ... The test added in this commit shows the problem. Previously the SigningKeyID was set to the RootCert not the local leaf signing cert. This same bug was fixed in two other places back in 2019, but this last one was missed. While fixing this bug I noticed I had the same few lines of code in 3 places, so I extracted a new function for them. There would be 4 places, but currently the InitializeCA flow sets this SigningKeyID in a different way, so I've left that alone for now.	3 years ago
Daniel Nephin	96f95889db	Merge pull request #11713 from hashicorp/dnephin/ca-test-names ... ca: make test naming consistent	3 years ago
Daniel Nephin	ff4581092e	Merge pull request #11671 from hashicorp/dnephin/ca-fix-storing-vault-intermediate ... ca: fix storing the leaf signing cert with Vault provider	3 years ago
Daniel Nephin	81afb208ac	Merge pull request #11677 from hashicorp/dnephin/freeport-interface ... sdk: use t.Cleanup in freeport and remove unnecessary calls	3 years ago
Daniel Nephin	447097b166	ca: make test naming consistent ... While working on the CA system it is important to be able to run all the tests related to the system, without having to wait for unrelated tests. There are many slow and unrelated tests in agent/consul, so we need some way to filter to only the relevant tests. This PR renames all the CA system related tests to start with either `TestCAMananger` for tests of internal operations that don't have RPC endpoint, or `TestConnectCA` for tests of RPC endpoints. This allows us to run all the test with: go test -run 'TestCAMananger|TestConnectCA' ./agent/consul The test naming follows an undocumented convention of naming tests as follows: Test[<struct name>_]<function name>[_<test case description>] I tried to always keep Primary/Secondary at the end of the description, and _Vault_ has to be in the middle because of our regex to run those tests as a separate CI job. You may notice some of the test names changed quite a bit. I did my best to identify the underlying method being tested, but I may have been slightly off in some cases.	3 years ago
FFMMM	384d497f26	add MustRevalidate flag to connect_ca_leaf cache type; always use on non-blocking queries (#11693) ... * always use MustRevalidate on non-blocking queries for connect ca leaf Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update agent/agent_endpoint_test.go Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	28a8a64019	ca: make getLeafSigningCertFromRoot safer ... As a method on the struct type this would not be safe to call without first checking c.isIntermediateUsedToSignLeaf. So for now, move this logic to the CAMananger, so that it is always correct.	3 years ago
Daniel Nephin	b29faa3e50	ca: fix stored CARoot representation with Vault provider ... We were not adding the local signing cert to the CARoot. This commit fixes that bug, and also adds support for fixing existing CARoot on upgrade. Also update the tests for both primary and secondary to be more strict. Check the SigningKeyID is correct after initialization and rotation.	3 years ago
Dan Upton	bf56a2c495	Rename `agent_master` ACL token in the API and CLI (#11669)	3 years ago
Dan Upton	d8afd2f6c8	Rename `master` and `agent_master` ACL tokens in the config file format (#11665)	3 years ago
Chris S. Kim	54e4d1b7b2	ENT to OSS sync (#11703)	3 years ago
R.B. Boyer	db91cbf484	auto-config: ensure the feature works properly with partitions (#11699)	3 years ago
Daniel Nephin	32ef9c5d5c	ca: add some godoc and func for finding leaf signing cert ... This will be used in a follow up commit.	3 years ago
Daniel Nephin	4185045a7f	sdk/freeport: rename Port to GetOne ... For better consistency with GetN	3 years ago
Chris S. Kim	56fab21582	Refactor test helper (#11689) ... Allow custom ACL root tokens to be passed	3 years ago
Chris S. Kim	36246c5791	acl: Fill authzContext from token in Coordinate endpoints (#11688)	3 years ago
freddygv	dd662d7058	Move ent config test to ent file	3 years ago
freddygv	5e1f7b7c36	Prevent partition-exports entry from OSS usage ... Validation was added on the config entry kind since that is called when validating config entries to bootstrap via agent configuration and when applying entries via the config RPC endpoint.	3 years ago
Daniel Nephin	e8312d6b5a	testing: remove unnecessary calls to freeport ... Previously we believe it was necessary for all code that required ports to use freeport to prevent conflicts. https://github.com/dnephin/freeport-test shows that it is actually save to use port 0 (`127.0.0.1:0`) as long as it is passed directly to `net.Listen`, and the listener holds the port for as long as it is needed. This works because freeport explicitly avoids the ephemeral port range, and port 0 always uses that range. As you can see from the test output of https://github.com/dnephin/freeport-test, the two systems never use overlapping ports. This commit converts all uses of freeport that were being passed directly to a net.Listen to use port 0 instead. This allows us to remove a bit of wrapping we had around httptest, in a couple places.	3 years ago
Daniel Nephin	d795a73f78	testing: use the new freeport interfaces	3 years ago
Daniel Nephin	56f9238d15	go-sso: remove returnFunc now that freeport handles return	3 years ago
Daniel Nephin	8c7475d95e	sdk: add freeport functions that use t.Cleanup	3 years ago
Daniel Nephin	59204598c8	ca: clean up unnecessary raft.Apply response checking ... In d2ab767fef raftApply was changed to handle this check in a single place, instad of having every caller check it. It looks like these few places were missed when I did that clean up. This commit removes the remaining resp.(error) checks, since they are all no-ops now.	3 years ago
Daniel Nephin	52f0853ff9	Merge pull request #11339 from hashicorp/dnephin/ca-manager-isolate-secondary-2 ... ca: reduce use of state in the secondary	3 years ago
Daniel Nephin	91a0c25932	ca: remove state check in secondarySetPrimaryRoots ... This function is only ever called from operations that have already acquired the state lock, so checking the value of state can never fail. This change is being made in preparation for splitting out a separate type for the secondary logic. The state can't easily be shared, so really only the expored top-level functions should acquire the 'state lock'.	3 years ago
Daniel Nephin	f1944458e4	ca: remove actingSecondaryCA ... This commit removes the actingSecondaryCA field, and removes the stateLock around it. This field was acting as a proxy for providerRoot != nil, so replace it with that check instead. The two methods which called secondarySetCAConfigured already set the state, so checking the state again at this point will not catch runtime errors (only programming errors, which we can catch with tests). In general, handling state transitions should be done on the "entrypoint" methods where execution starts, not in every internal method. This is being done to remove some unnecessary references to c.state, in preparations for extracting types for primary/secondary.	3 years ago
Daniel Nephin	b92084b8e8	ca: reduce consul provider backend interface a bit ... This makes it easier to fake, which will allow me to use the ConsulProvider as an 'external PKI' to test a customer setup where the actual root CA is not the root we use for the Consul CA. Replaces a call to the state store to fetch the clusterID with the clusterID field already available on the built-in provider.	3 years ago
Dhia Ayachi	3820e09a47	Partition/kv indexid sessions (#11639) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused operations_ent.go and operations_oss.go func * convert `indexNodeCheck` of `session_checks` table * partition `indexID` and `indexSession` of `tableSessionChecks` * remove partition for Checks as it's always use the session partition * partition sessions index id table * fix rebase issues Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dhia Ayachi	bb83624950	Partition session checks store (#11638) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused operations_ent.go and operations_oss.go func * remove unused const * convert `IndexID` of `session_checks` table * convert `indexSession` of `session_checks` table * convert `indexNodeCheck` of `session_checks` table * partition `indexID` and `indexSession` of `tableSessionChecks` * fix oss linter * fix review comments * remove partition for Checks as it's always use the session partition Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Chris S. Kim	2350e7e56a	cleanup: Clarify deprecated legacy intention endpoints (#11635)	3 years ago
Chris S. Kim	db5ee0e4d2	Merge from ent (#11506)	3 years ago
R.B. Boyer	dd4a59db8e	agent: purge service/check registration files for incorrect partitions on reload (#11607)	3 years ago
Iryna Shustava	0ee456649f	connect: Support auth methods for the vault connect CA provider (#11573) ... * Support vault auth methods for the Vault connect CA provider * Rotate the token (re-authenticate to vault using auth method) when the token can no longer be renewed	3 years ago