consul

Tree: 7423886136

Author	SHA1	Message	Date
Mark Anderson	c6ff4ba7d8	Support vault namespaces in connect CA (#12904 ) * Support vault namespaces in connect CA Follow on to some missed items from #12655 From an internal ticket "Support standard "Vault namespace in the path" semantics for Connect Vault CA Provider" Vault allows the namespace to be specified as a prefix in the path of a PKI definition, but our usage of the Vault API includes calls that don't support a namespaced key. In particular the sys.* family of calls simply appends the key, instead of prefixing the namespace in front of the path. Unfortunately it is difficult to reliably parse a path with a namespace; only vault knows what namespaces are present, and the '/' separator can be inside a key name, as well as separating path elements. This is in use in the wild; for example 'dc1/intermediate-key' is a relatively common naming schema. Instead we add two new fields: RootPKINamespace and IntermediatePKINamespace, which are the absolute namespace paths 'prefixed' in front of the respective PKI Paths. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Chris S. Kim	abc472f2a3	Default discovery chain when upstream targets a DestinationPeer (#12942 )	3 years ago
Mark Anderson	2fcac5224e	Merge pull request #12878 from hashicorp/ma/x-forwarded-client-cert Support x-forwarded-client-cert	3 years ago
Evan Culver	dfcd1f90a9	fix(ci): use correct variable syntax for build-distros job (#12933 )	3 years ago
Dan Upton	a668c36930	acl: gRPC login and logout endpoints (#12935 ) Introduces two new public gRPC endpoints (`Login` and `Logout`) and includes refactoring of the equivalent net/rpc endpoints to enable the majority of logic to be reused (i.e. by extracting the `Binder` and `TokenWriter` types). This contains the OSS portions of the following enterprise commits: - 75fcdbfcfa6af21d7128cb2544829ead0b1df603 - bce14b714151af74a7f0110843d640204082630a - cc508b70fbf58eda144d9af3d71bd0f483985893	3 years ago
Mark Anderson	97f19a6ec1	Fix tests for APPEND_FORWARD change Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	863bc16530	Change to use APPEND_FORWARD for terminating gateway Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	6430af1c0e	Update mesh config tests Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	05dc5a26b7	Docs and changelog edits Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	fee6c7a7b6	Fixup missed config entry Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	d7e7cb09dc	Add some docs Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	28b4b3a85d	Add x-forwarded-client-cert headers Description Add x-fowarded-client-cert information on trusted incoming connections. Envoy provides support forwarding and annotating the x-forwarded-client-cert header via the forward_client_cert_details set_current_client_cert_details filter fields. It would be helpful for consul to support this directly in its config. The escape hatches are a bit cumbersome for this purpose. This has been implemented on incoming connections to envoy. Outgoing (from the local service through the sidecar) will not have a certificate, and so are left alone. A service on an incoming connection will now get headers something like this: ``` X-Forwarded-Client-Cert:[By=spiffe://efad7282-d9b2-3298-f6d8-38b37fb58df3.consul/ns/default/dc/dc1/svc/counting;Hash=61ad5cbdfcb50f5a3ec0ca60923d61613c149a9d4495010a64175c05a0268ab2;Cert="-----BEGIN%20CERTIFICATE-----%0AMIICHDCCAcOgAwIBAgIBCDAKBggqhkjOPQQDAjAxMS8wLQYDVQQDEyZwcmktMTli%0AYXdyb2YuY29uc3VsLmNhLmVmYWQ3MjgyLmNvbnN1bDAeFw0yMjA0MjkwMzE0NTBa%0AFw0yMjA1MDIwMzE0NTBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARVIZ7Y%0AZEXfbOGBfxGa7Vuok1MIng%2FuzLQK2xLVlSTIPDbO5hstTGP%2B%2FGx182PYFP3jYqk5%0Aq6rYWe1wiPNMA30Io4H8MIH5MA4GA1UdDwEB%2FwQEAwIDuDAdBgNVHSUEFjAUBggr%0ABgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH%2FBAIwADApBgNVHQ4EIgQgrp4q50oX%0AHHghMbxz5Bk8OJFWMdfgH0Upr350WlhyxvkwKwYDVR0jBCQwIoAgUe6uERAIj%2FLM%0AyuFzDc3Wbp9TGAKBJYAwyhF14ToOQCMwYgYDVR0RAQH%2FBFgwVoZUc3BpZmZlOi8v%0AZWZhZDcyODItZDliMi0zMjk4LWY2ZDgtMzhiMzdmYjU4ZGYzLmNvbnN1bC9ucy9k%0AZWZhdWx0L2RjL2RjMS9zdmMvZGFzaGJvYXJkMAoGCCqGSM49BAMCA0cAMEQCIDwb%0AFlchufggNTijnQ5SUcvTZrWlZyq%2FrdVC20nbbmWLAiAVshNNv1xBqJI1NmY2HI9n%0AgRMfb8aEPVSuxEHhqy57eQ%3D%3D%0A-----END%20CERTIFICATE-----%0A";Chain="-----BEGIN%20CERTIFICATE-----%0AMIICHDCCAcOgAwIBAgIBCDAKBggqhkjOPQQDAjAxMS8wLQYDVQQDEyZwcmktMTli%0AYXdyb2YuY29uc3VsLmNhLmVmYWQ3MjgyLmNvbnN1bDAeFw0yMjA0MjkwMzE0NTBa%0AFw0yMjA1MDIwMzE0NTBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARVIZ7Y%0AZEXfbOGBfxGa7Vuok1MIng%2FuzLQK2xLVlSTIPDbO5hstTGP%2B%2FGx182PYFP3jYqk5%0Aq6rYWe1wiPNMA30Io4H8MIH5MA4GA1UdDwEB%2FwQEAwIDuDAdBgNVHSUEFjAUBggr%0ABgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH%2FBAIwADApBgNVHQ4EIgQgrp4q50oX%0AHHghMbxz5Bk8OJFWMdfgH0Upr350WlhyxvkwKwYDVR0jBCQwIoAgUe6uERAIj%2FLM%0AyuFzDc3Wbp9TGAKBJYAwyhF14ToOQCMwYgYDVR0RAQH%2FBFgwVoZUc3BpZmZlOi8v%0AZWZhZDcyODItZDliMi0zMjk4LWY2ZDgtMzhiMzdmYjU4ZGYzLmNvbnN1bC9ucy9k%0AZWZhdWx0L2RjL2RjMS9zdmMvZGFzaGJvYXJkMAoGCCqGSM49BAMCA0cAMEQCIDwb%0AFlchufggNTijnQ5SUcvTZrWlZyq%2FrdVC20nbbmWLAiAVshNNv1xBqJI1NmY2HI9n%0AgRMfb8aEPVSuxEHhqy57eQ%3D%3D%0A-----END%20CERTIFICATE-----%0A";Subject="";URI=spiffe://efad7282-d9b2-3298-f6d8-38b37fb58df3.consul/ns/default/dc/dc1/svc/dashboard] ``` Closes #12852	3 years ago
claire labry	8ebb515bfc	Merge pull request #12917 from hashicorp/add-release-config-key Add config key to the promote-staging event	3 years ago
Amier Chery	03ac931b52	Merge pull request #12631 from driesgroblerw/patch-1 Updated the link to acl-policies	3 years ago
DanStough	8d655ded4c	chore(ci): fix backport-assistant for stable website	3 years ago
Kyle Havlovitz	0696ed24c8	Merge pull request #12885 from hashicorp/acl-err-cache Store and return RPC error in ACL cache entries	3 years ago
Kyle Havlovitz	76d62a14f5	Return ACLRemoteError from cache and test it correctly	3 years ago
DanStough	e899e06c29	chore(ci): fix backport assistant	3 years ago
R.B. Boyer	bd87505bf2	ci: upgrade bats and the circle machine executors to get integration tests to function again (#12918 ) Bonus change: send less context when building the test-sds-server to speed up the setup.	3 years ago
Claire Labry	561221a343	Add config key to the promote-staging event	3 years ago
FFMMM	3b3f001580	[sync oss] api: add peering api module (#12911 )	3 years ago
Blake Covarrubias	54119f3225	docs: Add example Envoy escape hatch configs (#12764 ) Add example escape hatch configurations for all supported override types.	3 years ago
DanStough	b2a005342b	chore(ci): add initial support for backport assistant	3 years ago
Jared Kirschner	cf12f8af20	Merge pull request #12762 from hashicorp/jkirschner-hashicorp-patch-1 docs: use correct previous name of recovery token	3 years ago
Chris S. Kim	9791bad136	peering: Make Upstream peer-aware (#12900 ) Adds DestinationPeer field to Upstream. Adds Peer field to UpstreamID and its string conversion functions.	3 years ago
Jared Kirschner	5be6f3402d	Merge pull request #12902 from hashicorp/jkirschner-hashicorp-patch-2 docs: fix typo	3 years ago
Jared Kirschner	c1aacc2728	docs: fix typo	3 years ago
Jared Kirschner	0028d927e3	Merge pull request #12893 from hashicorp/docs/improve-consul-server-resilience docs: add guidance on improving Consul resilience	3 years ago
Chris S. Kim	0d66301ea7	Cleanup peering files that used error types that were removed (#12892 )	3 years ago
Jared Kirschner	de51780eb8	docs: add guidance on improving Consul resilience Discuss available strategies for improving server-level and infrastructure-level fault tolerance in Consul.	3 years ago
Jeff Apple	e286dc2a50	Merge pull request #12891 from hashicorp/docs-api-gateway-0.2.1 Docs: update for API Gateway v0.2.1	3 years ago
Mathew Estafanous	474385d153	Unify various status errors into one HTTP error type. (#12594 ) Replaces specific error types for HTTP Status codes with a generic HTTPError type. Co-authored-by: Chris S. Kim <ckim@hashicorp.com>	3 years ago
Jeff-Apple	e8a1a1eb68	Dcos: update for API Gateway v0.2.1	3 years ago
Jared Kirschner	d04fe6ca2c	Merge pull request #11810 from hashicorp/update-enterprise-packaging-in-feature-docs Update enterprise packaging in feature docs	3 years ago
Jared Kirschner	964afedd13	docs: improve ent overview headings	3 years ago
Jared Kirschner	1ca903d28d	docs: explicitly fill all ent feature matrix cells	3 years ago
Chris S. Kim	2626963db9	Add a Github action to remind people about backport automation (#12884 )	3 years ago
Kyle Havlovitz	0d8b187ea1	Store and return rpc error in acl cache entries	3 years ago
Jeff Apple	62311368c6	Merge pull request #12874 from hashicorp/japple-api-gw-fix-install-doc Docs: updated versions on install page and other minor fixes.	3 years ago
Jeff-Apple	144a27da3d	Docs: updated versions on install page and other minor fixes.	3 years ago
Mike Morris	80417f02dc	website(consul-api-gateway): fixup stray div tag and step 8 link rendering (#12873 )	3 years ago
Karl Cardenas	3bf17020d9	Merge pull request #12872 from hashicorp/markdown-fix docs: fixes makdown leakage	3 years ago
Karl Cardenas	dbaed47da2	docs: fixes makdown leakage	3 years ago
Jared Kirschner	33ccefcc4e	docs: update HCP Consul feature matrix	3 years ago
Nathan Coleman	6a4ca9c5a7	Merge pull request #12871 from hashicorp/apigw-crd-version Update version pin for consul-api-gateway install docs	3 years ago
Nathan Coleman	8208c2daf9	Update version pin for consul-api-gateway CRD install	3 years ago
Jeff Apple	359d62a49d	Merge pull request #12863 from hashicorp/api-gateway-v0.2-docs Update product docs for release of Consul API Gateway v0.2	3 years ago
Nathan Coleman	1e84407681	Update minimum Consul version in Tech Specs	3 years ago
Jeff-Apple	24682ccc8a	correction to the API Gateway 0.2 release notes.	3 years ago
Nathan Coleman	0104383203	Instruct user to update apiGateway.image in values.yaml	3 years ago

... 3 4 5 6 7 ...

17478 Commits (7423886136e18fd57538f2bfa3df11473f19763f) All Branches Search

17478 Commits (7423886136e18fd57538f2bfa3df11473f19763f)

All Branches