consul

Commit Graph

Author	SHA1	Message	Date
Pierre Souchay	73056fecf8	Fixed unstable test TestForwardSignals() Sometimes, in the CI, it could receive a SIGURG, producing this line: FAIL: TestForwardSignals/signal-interrupt (0.06s) util_test.go:286: expected to read line "signal: interrupt" but got "signal: urgent I/O condition" Only forward the signals we test to avoid this kind of false positive Example of such unstable errors in CI: https://circleci.com/gh/hashicorp/consul/153571	5 years ago
Pierre Souchay	09e638a9c6	tests: more tolerance to latency for unstable test `TestCacheNotifyPolling()`. (#7574 )	5 years ago
Freddy	b61214ef24	Fix regression with gateway registration and update docs (#7582 )	5 years ago
Matt Keeler	8aec09aa8f	Ensure that token clone copies the roles (#7577 )	5 years ago
Chris Piraino	bcb7a89fda	Update CHANGELOG.md	5 years ago
Chris Piraino	584f90bbeb	Fix flapping of mesh gateway connect-service watches (#7575 )	5 years ago
Pierre Souchay	2a8bf45e38	agent: show warning when enable_script_checks is enabled without safty net (#7437 ) In order to enforce a bit security on Consul agents, add a new method in agent to highlight possible security issues. This does not return an error for now, but might in the future. For now, it detects issues such as: https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/ This would display this kind of messages: ``` 2020-03-11T18:27:49.873+0100 [ERROR] agent: [SECURITY] issue: error="using enable-script-checks without ACLs and without allow_write_http_from is DANGEROUS, use enable-local-script-checks instead see https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/" ```	5 years ago
Andy Lindeman	fb0a990e4d	agent: rewrite checks with proxy address, not local service address (#7518 ) Exposing checks is supposed to allow a Consul agent bound to a different IP address (e.g., in a different Kubernetes pod) to access healthchecks through the proxy while the underlying service binds to localhost. This is an important security feature that makes sure no external traffic reaches the service except through the proxy. However, as far as I can tell, this is subtly broken in the case where the Consul agent cannot reach the proxy over localhost. If a proxy is configured with: `{ LocalServiceAddress: "127.0.0.1", Checks: true }`, as is typical with a sidecar proxy, the Consul checks are currently rewritten to `127.0.0.1:<random port>`. A Consul agent that does not share the loopback address cannot reach this address. Just to make sure I was not misunderstanding, I tried configuring the proxy with `{ LocalServiceAddress: "<pod ip>", Checks: true }`. In this case, while the checks are rewritten as expected and the agent can reach the dynamic port, the proxy can no longer reach its backend because the traffic is no longer on the loopback interface. I think rewriting the checks to use `proxy.Address`, the proxy's own address, is more correct in this case. That is the IP where the proxy can be reached, both by other proxies and by a Consul agent running on a different IP. The local service address should continue to use `127.0.0.1` in most cases.	5 years ago
Andy Lindeman	c1cb18c648	proxycfg: support path exposed with non-HTTP2 protocol (#7510 ) If a proxied service is a gRPC or HTTP2 service, but a path is exposed using the HTTP1 or TCP protocol, Envoy should not be configured with `http2ProtocolOptions` for the cluster backing the path. A situation where this comes up is a gRPC service whose healthcheck or metrics route (e.g. for Prometheus) is an HTTP1 service running on a different port. Previously, if these were exposed either using `Expose: { Checks: true }` or `Expose: { Paths: ... }`, Envoy would still be configured to communicate with the path over HTTP2, which would not work properly.	5 years ago
Pierre Souchay	be1c5c4b48	config: validate system limits against limits.http_max_conns_per_client (#7434 ) I spent some time today on my local Mac to figure out why Consul 1.6.3+ was not accepting limits.http_max_conns_per_client. This adds an explicit check on number of file descriptors to be sure it might work (this is no guarantee as if many clients are reaching the agent, it might consume even more file descriptors) Anyway, many users are fighting with RLIMIT_NOFILE, having a clear message would allow them to figure out what to fix. Example of message (reload or start): ``` 2020-03-11T16:38:37.062+0100 [ERROR] agent: Error starting agent: error="system allows a max of 512 file descriptors, but limits.http_max_conns_per_client: 8192 needs at least 8212" ```	5 years ago
Daniel Nephin	a6cede401a	Merge pull request #7572 from hashicorp/dnephin/ci-fix-go-mod-download ci: Fix working_directory for go mod download	5 years ago
Daniel Nephin	625ce9baf2	ci: Fix working_directory for go mod download The previous PR which added these was accidentally performing the download in the root directory. For the api, and sdk directories it should be in done in the same directory that will be used to run tests. Otherwise the wrong dependencies will be downloaded which may add unnecessary time to the CI run.	5 years ago
Shaker Islam	ac309d55f4	docs: document exported functions in agent.go (closes #7101 ) (#7366 ) and fix one linter error	5 years ago
R.B. Boyer	c2f4063103	update changelog	5 years ago
Pierre Souchay	5703aadb59	[BUGFIX] Fix race condition in freeport (#7567 ) This removes a race condition in reset since pendingPorts can be set to nil in reset() If ticker is hit at wrong time, it would crash the unit test. We ensure in reset to avoid this race condition by cancelling the goroutine using killTicker chan. We also properly clean up eveything, so garbage collector can work as expected. To reproduce existing bug: `while go test -timeout 30s github.com/hashicorp/consul/sdk/freeport -run '^(Test.)$'; do go clean -testcache; done` Will crash after a few 10s runs on my machine. Error could be seen in unit tests sometimes: [INFO] freeport: resetting the freeport package state panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x1125536] goroutine 25 [running]: container/list.(List).Len(...) /usr/local/Cellar/go/1.14/libexec/src/container/list/list.go:66 github.com/hashicorp/consul/sdk/freeport.checkFreedPortsOnce() /Users/p.souchay/go/src/github.com/hashicorp/consul/sdk/freeport/freeport.go:157 +0x86 github.com/hashicorp/consul/sdk/freeport.checkFreedPorts() /Users/p.souchay/go/src/github.com/hashicorp/consul/sdk/freeport/freeport.go:147 +0x71 created by github.com/hashicorp/consul/sdk/freeport.initialize /Users/p.souchay/go/src/github.com/hashicorp/consul/sdk/freeport/freeport.go:113 +0x2cf FAIL github.com/hashicorp/consul/sdk/freeport 1.607s	5 years ago
Daniel Nephin	fce56e4cb6	Merge pull request #7570 from pierresouchay/fix_lint_upstream_due_to_change_args_in_NewTestAgent [FIX BUILD] fix build due to merge of #7562	5 years ago
Pierre Souchay	08acd6a03e	[FIX BUILD] fix build due to merge of #7562 Due to merge #7562, upstream does not compile anymore. Error is: ERRO Running error: gofmt: analysis skipped: errors in package: [/Users/p.souchay/go/src/github.com/hashicorp/consul/agent/config_endpoint_test.go:188:33: too many arguments]	5 years ago
Daniel Nephin	0d8edc3e27	Merge pull request #7562 from hashicorp/dnephin/remove-tname-from-name testing: Remove old default value from NewTestAgent() calls	5 years ago
Daniel Nephin	76f03982eb	Merge pull request #7427 from hashicorp/dnephin/website-fix-errrors-in-upgrade-docs docs: fix some errors in upgrade-specific	5 years ago
Daniel Nephin	2c631a7a78	Merge pull request #7465 from hashicorp/dnephin/correct-docs-log-file docs: Update config reference for log-file	5 years ago
Daniel Nephin	5f44bbcac2	Merge pull request #7519 from hashicorp/dnephin/help-to-stdout cli: send requested help text to stdout	5 years ago
Daniel Nephin	190fc3c732	Merge pull request #7533 from hashicorp/dnephin/xds-server-1 agent/xds: small cleanup	5 years ago
Hans Hasselberg	efaf0f9a18	docs: revert "docs: fix param for register checks id->checkid (#7393 )" (#7565 ) This reverts commit `ed5202943e`.	5 years ago
Rasmus Mikkelsen	ed5202943e	docs: fix param for register checks id->checkid (#7393 )	5 years ago
John Cowen	8d4631526c	ui: Fix token duplication bug (#7552 ) We need to detect whether an object is an ember-data snapshot or just a plain object, and we where restricted from using `instanceof` due to ember-data's `Snapshot` class being private. We'd chosen to go with `constructor.name` instead, which seemed to work, but when the javascript gets minifed the name of the contructor is also minified and therefore is not what you are expecting. This commit reverts to our original idea of checking for the existence and type of the `.attributes` function, which is the function we require within the conditional, and therefore is more reliable (if the function doesn't exist it will error out during development aswell as production)	5 years ago
Emre Savcı	2083b7b04d	agent: add len, cap while initializing arrays	5 years ago
Pierre Souchay	4d35816bee	tests: fixed unstable test TestAPI_AgentMonitor (#7561 ) Similar fix as https://github.com/hashicorp/consul/pull/7541	5 years ago
Daniel Nephin	e759daafdd	Rename NewTestAgentWithFields to StartTestAgent This function now only starts the agent. Using: git grep -l 'StartTestAgent(t, true,' \| \ xargs sed -i -e 's/StartTestAgent(t, true,/StartTestAgent(t,/g'	5 years ago
Daniel Nephin	f9f6b14533	Convert the remaining calls to NewTestAgentWithFields After removing the t.Name() parameter with sed, convert the last few tests which use a custom name to call NewTestAgentWithFields instead.	5 years ago
Daniel Nephin	9d83a45663	Merge pull request #7557 from hashicorp/dnephin/ci-small-improvements ci: Upload coverage from each job	5 years ago
Daniel Nephin	0c409d460f	Merge pull request #7470 from hashicorp/dnephin/dns-unused-params dns: Remove a few unused function parameters	5 years ago
Andreas Gruhler	3cb9aa8010	docs: make example code for RedundancyZoneTag match description (#7464 )	5 years ago
Pierre Souchay	54b22c638d	config: allow running `consul agent -dev -ui-dir=some_path` (#7525 ) When run in with `-dev` in DevMode, it is not possible to replace the embeded UI with another one because `-dev` implies `-ui`. This commit allows this an slightly change the error message about Consul 0.7.0 which is very old and does not apply to current version anyway.	5 years ago
Geoffrey Grosenbach	ab6c410064	docs: add link to Learn from downloads page (#7534 ) Adds a link to Learn from the downloads page as well as a link to the Consul Template guide.	5 years ago
Pierre Souchay	eafe9a895a	tests: fixed bats warning (#7544 ) This fixes this bats warning: duplicate test name(s) in /workdir/primary/bats/verify.bats: test_s1_upstream_made_1_connection Test was already defined at line 42, rename it to avoid test name duplication	5 years ago
Daniel Nephin	475659a132	Remove name from NewTestAgent Using: git grep -l 'NewTestAgent(t, t.Name(),' \| \ xargs sed -i -e 's/NewTestAgent(t, t.Name(),/NewTestAgent(t,/g'	5 years ago
Freddy	90576060bc	Add config entry for terminating gateways (#7545 ) This config entry will be used to configure terminating gateways. It accepts the name of the gateway and a list of services the gateway will represent. For each service users will be able to specify: its name, namespace, and additional options for TLS origination. Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Daniel Nephin	66a51c9701	Upload coverage from each job Allows us to remove the merge coverage report step	5 years ago
Kyle Havlovitz	c911174327	Add config entry/state for Ingress Gateways (#7483 ) * Add Ingress gateway config entry and other relevant structs * Add api package tests for ingress gateways * Embed EnterpriseMeta into ingress service struct * Add namespace fields to api module and test consul config write decoding * Don't require a port for ingress gateways * Add snakeJSON and camelJSON cases in command test * Run Normalize on service's ent metadata Sadly cannot think of a way to test this in OSS. * Every protocol requires at least 1 service * Validate ingress protocols * Update agent/structs/config_entry_gateways.go Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Daniel Nephin	5035fe782a	Merge pull request #7555 from hashicorp/dnephin/ci-small-improvements ci: small improvements	5 years ago
Daniel Nephin	2a676dc287	ci: Increase GOMAXPROCS so that the tests run faster	5 years ago
Daniel Nephin	a79417f973	ci: small improvements Run 'go mod download' first so that dependencies are pulled in a separate step. This makes the test splitting and test output easier to scroll through. Remove test splitting from the api/sdk test runs. These jobs do not use parallelism, so there is no test timing data injected into the job. They can't be split. Remove the dependencies from the go-test job, so that we can start the slowest test job earlier in the workflow.	5 years ago
Daniel Nephin	9d959907a4	Merge pull request #7485 from hashicorp/dnephin/do-not-skip-tests-on-ci ci: Make it harder to accidentally skip tests on CI, and doc why some are skipped	5 years ago
Daniel Nephin	fd7383eb6e	Merge pull request #7546 from hashicorp/dnephin/logging-in-tests testing: Improve logging from TestAgent	5 years ago
John Cowen	6ffe0e6fe4	ui: Use the `each key=""` parameter to force ember to reuse DOM (#7550 ) Ember tries to reuse DOM elements when it can but as ember looks for changes to objects rather than the DOM itself sometimes. This and the fact that an objects identity may change even though its value hasn't, results in ember occasionally re-mutating DOM when it doesn't need to. The `each` helper includes a `key` attribute to hint to ember what it should look for when deciding whether something has changed, rather than the objects identity. https://api.emberjs.com/ember/release/classes/Ember.Templates.helpers/methods/each#specifying-keys We use this here to fix an issue where DOM was being redrawn after the user had scrolled the page and was therefore resetting the scroll back to 0 (the top of the page)	5 years ago
Daniel Nephin	ad7c78f134	Remove t.Name() from TestAgent.Name And re-add the name to the logger so that log messages from different agents in a single can be identified.	5 years ago
Jono Sosulska	ce8b38ac01	Updated Security Model and FAQ pages (#7528 ) * Updated Security Model and FAQ pages	5 years ago
Daniel Nephin	231c99f7b4	Document Agent.LogOutput	5 years ago
Pierre Souchay	f1f778ffcc	FIX flaky test: TestAPI_AgentMonitorJSON	5 years ago
Daniel Nephin	09d0876b6c	command: remove unused logOutput field	5 years ago

1 2 3 4 5 ...

11165 Commits (73056fecf8ab4692b1d6a31848520e8a7ca431bc) All Branches Search

11165 Commits (73056fecf8ab4692b1d6a31848520e8a7ca431bc)

All Branches