1658 Commits (76cf54068b98a334e4058858b5de69fd3c77d17e)

Author	SHA1	Message	Date
hashicorp-ci	a4431da1cc	Merge Consul OSS branch 'master' at commit ef257b084d	5 years ago
javicrespo	b006060d4c	log rotation: limit count of rotated log files (#5831)	5 years ago
Christian Muehlhaeuser	61ff1d20bf	Avoid unnecessary conversions (#6178) ... Those values already have the right type.	5 years ago
Christian Muehlhaeuser	1366bebf7f	Fixed typos in comments (#6175) ... Just a few nitpicky typo fixes.	5 years ago
Christian Muehlhaeuser	16193665ca	Fixed a few tautological condition mistakes (#6177) ... None of these changes should have any side-effects. They're merely fixing tautological mistakes.	5 years ago
Christian Muehlhaeuser	ed4e64f6b2	Fixed nil check for token (#6179) ... I can only assume we want to check for the retrieved `updatedToken` to not be nil, before accessing it below. `token` can't possibly be nil at this point, as we accessed `token.AccessorID` just before.	5 years ago
Alvin Huang	6f1953d96d	Merge branch 'master' into release/1-6	5 years ago
R.B. Boyer	d7a5158805	xds: allow http match criteria to be applied to routes on services using grpc protocols (#6149)	5 years ago
R.B. Boyer	b16d7f00bc	agent: avoid reverting any check updates that occur while a service is being added or the config is reloaded (#6144)	5 years ago
Freddy	5526cfac8b	Reduce number of servers in TestServer_Expect_NonVoters (#6155)	5 years ago
Freddy	59dbd070d7	More flaky test fixes (#6151) ... * Add retry to TestAPI_ClientTxn * Add retry to TestLeader_RegisterMember * Account for empty watch result in ConnectRootsWatch	5 years ago
hashicorp-ci	fa20c7db97	Merge Consul OSS branch 'master' at commit 95dbb7f2f1	5 years ago
Sarah Adams	ea2bd5b728	http/tcp checks: fix long timeout behavior to default to user-configured value (#6094) ... Fixes #5834	5 years ago
Freddy	d219e31db8	Update retries that weren't using retry.R (#6146)	5 years ago
hashicorp-ci	4bb858161e	update bindata_assetfs.go	5 years ago
R.B. Boyer	e8132b61c0	add test for discovery chain agent cache-type (#6130)	5 years ago
Jack Pearkes	338aed32af	Merge branch 'master' into release/1-6	5 years ago
Matt Keeler	4728329aeb	Various Gateway Fixes (#6093) ... * Ensure the mesh gateway configuration comes back in the api within each upstream * Add a test for the MeshGatewayConfig in the ToAPI functions * Ensure we don’t use gateways for dc local connections * Update the svc kind index for deletions * Replace the proxycfg.state cache with an interface for testing Also start implementing proxycfg state testing. * Update the state tests to verify some gateway watches for upstream-targets of a discovery chain.	5 years ago
Sarah Adams	ce3a6e8660	fix flaky test TestACLEndpoint_SecureIntroEndpoints_OnlyCreateLocalData (#6116) ... * fix test to write only to dc2 (typo) * fix retry behavior in existing test (was being used incorrectly)	5 years ago
R.B. Boyer	bcd2de3a2e	implement some missing service-router features and add more xDS testing (#6065) ... - also implement OnlyPassing filters for non-gateway clusters	5 years ago
R.B. Boyer	9138a97054	Fix bug in service-resolver redirects if the destination uses a default resolver. (#6122) ... Also: - add back an internal http endpoint to dump a compiled discovery chain for debugging purposes Before the CompiledDiscoveryChain.IsDefault() method would test: - is this chain just one resolver step? - is that resolver step just the default? But what I forgot to test: - is that resolver step for the same service that the chain represents? This last point is important because if you configured just one config entry: kind = "service-resolver" name = "web" redirect { service = "other" } and requested the chain for "web" you'd get back a **default** resolver for "other". In the xDS code the IsDefault() method is used to determine if this chain is "empty". If it is then we use the pre-discovery-chain logic that just uses data embedded in the Upstream object (and still lets the escape hatches function). In the example above that means certain parts of the xDS code were going to try referencing a cluster named "web..." despite the other parts of the xDS code maintaining clusters named "other...".	5 years ago
R.B. Boyer	67a36e3452	handle structs.ConfigEntry decoding similarly to api.ConfigEntry decoding (#6106) ... Both 'consul config write' and server bootstrap config entries take a decoding detour through mapstructure on the way from HCL to an actual struct. They both may take in snake_case or CamelCase (for consistency) so need very similar handling. Unfortunately since they are operating on mirror universes of structs (api.* vs structs.*) the code cannot be identitical, so try to share the kind-configuration and duplicate the rest for now.	5 years ago
Matt Keeler	6e65811db2	Envoy CLI bind addresses (#6107) ... * Ensure we MapWalk the proxy config in the NodeService and ServiceNode structs This gets rid of some json encoder errors in the catalog endpoints * Allow passing explicit bind addresses to envoy * Move map walking to the ConnectProxyConfig struct Any place where this struct gets JSON encoded will benefit as opposed to having to implement it everywhere. * Fail when a non-empty address is provided and not bindable * camel case * Update command/connect/envoy/envoy.go Co-Authored-By: Paul Banks <banks@banksco.de>	5 years ago
Freddy	5873c56a03	Flaky test overhaul (#6100)	5 years ago
Freddy	4033a4d632	Remove dummy config (#6121)	5 years ago
Freddy	0b9111714b	Update TestServer creation in sdk/testutil (#6084) ... * Retry the creation of the test server three times. * Reduce the retry timeout for the API wait to 2 seconds, opting to fail faster and start over. * Remove wait for leader from server creation. This wait can be added on a test by test basis now that the function is being exported. * Remove wait for anti-entropy sync. This is built into the existing WaitForSerfCheck func, so that can be used if the anti-entropy wait is needed	5 years ago
Freddy	0f8837824e	Clean up StatsFetcher work when context is exceeded (#6086)	5 years ago
Matt Keeler	de23af071a	Move ctx and cancel func setup into the Replicator.Start (#6115) ... Previously a sequence of events like: Start Stop Start Stop would segfault on the second stop because the original ctx and cancel func were only initialized during the constructor and not during Start.	5 years ago
hashicorp-ci	7e379bb7f7	update bindata_assetfs.go	5 years ago
Jack Pearkes	e6f1b78efb	Make cluster names SNI always (#6081) ... * Make cluster names SNI always * Update some tests * Ensure we check for prepared query types * Use sni for route cluster names * Proper mesh gateway mode defaulting when the discovery chain is used * Ignore service splits from PatchSliceOfMaps * Update some xds golden files for proper test output * Allow for grpc/http listeners/cluster configs with the disco chain * Update stats expectation	5 years ago
Michael Schurter	b5aab27c21	connect: allow overriding envoy listener bind_address (#6033) ... * connect: allow overriding envoy listener bind_address * Update agent/xds/config.go Co-Authored-By: Kyle Havlovitz <kylehav@gmail.com> * connect: allow overriding envoy listener bind_port * envoy: support unix sockets for grpc in bootstrap Add AgentSocket BootstrapTplArgs which if set overrides the AgentAddress and AgentPort to generate a bootstrap which points Envoy to a unix socket file instead of an ip:port. * Add a test for passing the consul addr as a unix socket * Fix config formatting for envoy bootstrap tests * Fix listeners test cases for bind addr/port * Update website/source/docs/connect/proxies/envoy.md	5 years ago
Matt Keeler	3d562bee5c	Fix Internal.ServiceDump blocking (#6076) ... maxIndexWatchTxn was only watching the IndexEntry of the max index of all the entries. It needed to watch all of them regardless of which was the max. Also plumbed the query source through in the proxy config to help better track requests.	5 years ago
Matt Keeler	62ad0294d4	Don't use WatchedDatacenters in the xds code as thsoe get nil'ed out prior to sending to xds	5 years ago
Matt Keeler	d2b00bd591	xds message ordering (#6061) ... xds message ordering	5 years ago
hashicorp-ci	7a32c5a618	Merge Consul OSS branch 'master' at commit a58d8e91ac	5 years ago
Matt Keeler	25f580bcaa	Fix a bunch of xds flaky tests ... The clusters/endpoints test were still relying on deterministic ordering of clusters/endpoints which cannot be relied upon due to golang purposefully not providing any guarantee about consistent interation ordering of maps. Also fixed a small bug in the connect proxy cluster generation that was causing the clusters slice to be double the size it needed to with the first half being all nil pointers.	5 years ago
Matt Keeler	3eb3ee5a15	Merge pull request #6053 from hashicorp/gateways_and_resolvers ... Integrate Mesh Gateways with ServiceResolverSubsets	5 years ago
R.B. Boyer	43770b9391	digest the proxy-defaults protocol into the graph (#6050)	5 years ago
Matt Keeler	a8e2e866e3	Update xds/proxycfg tests to use the same looking trust domain as a normal system ... This is to prevent confusion about what our SNI fields actually look like.	5 years ago
Matt Keeler	a7421c160f	Implement mesh gateway management of service subsets ... Fixup some error handling	5 years ago
Matt Keeler	3b6d5e382a	Implement caching for config entry lists ... Update agent/cache-types/config_entry.go Co-Authored-By: R.B. Boyer <public@richardboyer.net>	5 years ago
R.B. Boyer	4bdb690a25	activate most discovery chain features in xDS for envoy (#6024)	5 years ago
Matt Keeler	bdebe62fd0	Fix some tests that I broke when refactoring the ConfigSnapshot (#6051) ... * Fix some tests that I broke when refactoring the ConfigSnapshot * Make sure the MeshGateway config is added to all the right api structs * Fix some more tests	5 years ago
Pierre Souchay	fd9237a1ff	Bump timeout in TestManager_BasicLifecycle (#6030)	5 years ago
Matt Keeler	8d953f5840	Implement Mesh Gateways ... This includes both ingress and egress functionality.	5 years ago
Matt Keeler	da8db83ddf	Fix secondary dc connect CA roots watch issue ... The general problem was that a the CA config which contained the trust domain was happening outside of the blocking mechanism so if the client started the blocking query before the primary dcs roots had been set then a state trust domain was being pushed down. This was fixed here but in the future we should probably fixup the CA initialization code to not initialize the CA config twice when it doesn’t need to.	5 years ago
Matt Keeler	4bc1277315	Include a content hash of the intention for use during replication	5 years ago
Matt Keeler	747ae6bdf5	Implement intention replication and secondary CA initialization	5 years ago
Matt Keeler	3943e38133	Implement Kind based ServiceDump and caching of the ServiceDump RPC	5 years ago
R.B. Boyer	2ad516aeaf	do some initial config entry graph validation during writes (#6047)	5 years ago
hashicorp-ci	43bda6fb76	Merge Consul OSS branch 'master' at commit e91f73f592	5 years ago
Sarah Christoff	f09af53894	Remove failed nodes from serfWAN (#6028) ... * Prune Servers from WAN and LAN * cleaned up and fixed LAN to WAN * moving things around * force-leave remove from serfWAN, create pruneSerfWAN * removed serfWAN remove, reduced complexity, fixed comments * add another place to remove from serfWAN * add nil check * Update agent/consul/server.go Co-Authored-By: Paul Banks <banks@banksco.de>	6 years ago
R.B. Boyer	38d76c624e	Allow for both snake_case and CamelCase for config entries written with 'consul config write'. (#6044) ... This also has the added benefit of fixing an issue with passing time.Duration fields through config entries.	6 years ago
Hans Hasselberg	a82e6a7fd3	Release v1.5.2	6 years ago
Hans Hasselberg	33a7df3330	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597)	6 years ago
R.B. Boyer	6a52f9f9fb	initial version of L7 config entry compiler (#5994) ... With this you should be able to fetch all of the relevant discovery chain config entries from the state store in one query and then feed them into the compiler outside of a transaction. There are a lot of TODOs scattered through here, but they're mostly around handling fun edge cases and can be deferred until more of the plumbing works completely.	6 years ago
R.B. Boyer	ceef44bbc9	adding new config entries for L7 discovery chain (unused) (#5987)	6 years ago
Todd Radel	a18b6d5ab9	connect: store signingKeyId instead of authorityKeyId (#6005)	6 years ago
R.B. Boyer	f7fdf18335	fix test that was failing after #6013 (#6026)	6 years ago
Aestek	81f8092a42	acl: allow service deregistration with node write permission (#5217) ... With ACLs enabled if an agent is wiped and restarted without a leave it can no longer deregister the services it had previously registered because it no longer has the tokens the services were registered with. To remedy that we allow service deregistration from tokens with node write permission.	6 years ago
Akshay Ganeshen	98a35fbe69	dns: support alt domains for dns resolution (#5940) ... this adds an option for an alt domain to be used with dns while migrating to a new consul domain.	6 years ago
hashicorp-ci	f4304e2e5b	Merge Consul OSS branch 'master' at commit 4eb73973b6	6 years ago
Pierre Souchay	4eb73973b6	agent: added metadata information about servers into consul service description (#5455) ... This allows have information about servers from HTTP APIs without using the command line.	6 years ago
Sarah Christoff	d3d92d76f3	ui: modify content path (#5950) ... * Add ui-content-path flag * tests complete, regex validator on string, index.html updated * cleaning up debugging stuff * ui: Enable ember environment configuration to be set via the go binary at runtime (#5934) * ui: Only inject {{.ContentPath}} if we are makeing a prod build... ...otherwise we just use the current rootURL This gets injected into a <base /> node which solves the assets path problem but not the ember problem * ui: Pull out the <base href=""> value and inject it into ember env See previous commit: The <base href=""> value is 'sometimes' injected from go at index serve time. We pass this value down to ember by overwriting the ember config that is injected via a <meta> tag. This has to be done before ember bootup. Sometimes (during testing and development, basically not production) this is injected with the already existing value, in which case this essentially changes nothing. The code here is slightly abstracted away from our specific usage to make it easier for anyone else to use, and also make sure we can cope with using this same method to pass variables down from the CLI through to ember in the future. * ui: We can't use <base /> move everything to javascript (#5941) Unfortuantely we can't seem to be able to use <base> and rootURL together as URL paths will get doubled up (`ui/ui/`). This moves all the things that we need to interpolate with .ContentPath to the `startup` javascript so we can conditionally print out `{{.ContentPath}}` in lots of places (now we can't use base) * fixed when we serve index.html * ui: For writing a ContentPath, we also need to cope with testing... (#5945) ...and potentially more environments Testing has more additional things in a separate index.html in `tests/` This make the entire thing a little saner and uses just javascriopt template literals instead of a pseudo handbrake synatx for our templating of these files. Intead of just templating the entire file this way, we still only template `{{content-for 'head'}}` and `{{content-for 'body'}}` in this way to ensure we support other plugins/addons * build: Loosen up the regex for retrieving the CONSUL_VERSION (#5946) * build: Loosen up the regex for retrieving the CONSUL_VERSION 1. Previously the `sed` replacement was searching for the CONSUL_VERSION comment at the start of a line, it no longer does this to allow for indentation. 2. Both `grep` and `sed` where looking for the omment at the end of the line. We've removed this restriction here. We don't need to remove it right now, but if we ever put the comment followed by something here the searching would break. 3. Added `xargs` for trimming the resulting version string. We aren't using this already in the rest of the scripts, but we are pretty sure this is available on most systems. * ui: Fix erroneous variable, and also force an ember cache clean on build 1. We referenced a variable incorrectly here, this fixes that. 2. We also made sure that every `make` target clears ember's `tmp` cache to ensure that its not using any caches that have since been edited everytime we call a `make` target. * added docs, fixed encoding * fixed go fmt * Update agent/config/config.go Co-Authored-By: R.B. Boyer <public@richardboyer.net> * Completed Suggestions * run gofmt on http.go * fix testsanitize * fix fullconfig/hcl by setting correct 'want' * ran gofmt on agent/config/runtime_test.go * Update website/source/docs/agent/options.html.md Co-Authored-By: Hans Hasselberg <me@hans.io> * Update website/source/docs/agent/options.html.md Co-Authored-By: kaitlincarter-hc <43049322+kaitlincarter-hc@users.noreply.github.com> * remove contentpath from redirectFS struct	6 years ago
Pierre Souchay	0e907f5aa8	Support for maximum size for Output of checks (#5233) ... * Support for maximum size for Output of checks This PR allows users to limit the size of output produced by checks at the agent and check level. When set at the agent level, it will limit the output for all checks monitored by the agent. When set at the check level, it can override the agent max for a specific check but only if it is lower than the agent max. Default value is 4k, and input must be at least 1.	6 years ago
hashicorp-ci	4d185baf55	Merge Consul OSS branch 'master' at commit 88b15d84f9 ... skip-checks: true	6 years ago
Matt Keeler	813e009a2d	Prepare for having different service kinds that are all generic… (#6013) ... Default to internal error when service kind is unknown	6 years ago
Matt Keeler	43c5ba0304	New Cache Types (#5995) ... * Add a cache type for the Catalog.ListServices endpoint * Add a cache type for the Catalog.ListDatacenters endpoint	6 years ago
Matt Keeler	19e70c46bf	Ensure that looking for services by addreses works with Tagged Addresses (#5984)	6 years ago
Matt Keeler	6cc1451895	Update some tests to fix ContentHash broken by the tagged service addresses (#5996)	6 years ago
Hans Hasselberg	f13fe4b304	agent: transfer leadership when establishLeadership fails (#5247)	6 years ago
Aestek	b839f52195	kv: do not trigger watches when setting the same value (#5885) ... If a KVSet is performed but does not update the entry, do not trigger watches for this key. This avoids releasing blocking queries for KV values that did not actually changed.	6 years ago
Aestek	24a0f2bba2	ae: use stale requests when performing full sync (#5873) ... Read requests performed during anti antropy full sync currently target the leader only. This generates a non-negligible load on the leader when the DC is large enough and can be offloaded to the followers following the "eventually consistent" policy for the agent state. We switch the AE read calls to use stale requests with a small (2s) MaxStaleDuration value and make sure we do not read too fast after a write.	6 years ago
Matt Keeler	f3d9b999ee	Add tagged addresses for services (#5965) ... This allows addresses to be tagged at the service level similar to what we allow for nodes already. The address translation that can be enabled with the `translate_wan_addrs` config was updated to take these new addresses into account as well.	6 years ago
Matt Keeler	2557d7a6cc	Fix CAS operations on Services (#5971) ... * Fix CAS operations on services * Update agent/consul/state/catalog_test.go Co-Authored-By: R.B. Boyer <public@richardboyer.net>	6 years ago
Paul Banks	acfcc7daf4	Add rate limiting to RPCs sent within a server instance too (#5927)	6 years ago
Paul Banks	ffcfdf29fc	Upgrade xDS (go-control-plane) API to support Envoy 1.10. (#5872) ... * Upgrade xDS (go-control-plane) API to support Envoy 1.10. This includes backwards compatibility shim to work around the ext_authz package rename in 1.10. It also adds integration test support in CI for 1.10.0. * Fix go vet complaints * go mod vendor * Update Envoy version info in docs * Update website/source/docs/connect/proxies/envoy.md	6 years ago
Pierre Souchay	4a4c63bda0	Ensure Consul is IPv6 compliant (#5468)	6 years ago
Matt Keeler	2ba6c3ac00	Update links to envoy docs on xDS protocol (#5871)	6 years ago
R.B. Boyer	40336fd353	agent: fix several data races and bugs related to node-local alias checks (#5876) ... The observed bug was that a full restart of a consul datacenter (servers and clients) in conjunction with a restart of a connect-flavored application with bring-your-own-service-registration logic would very frequently cause the envoy sidecar service check to never reflect the aliased service. Over the course of investigation several bugs and unfortunate interactions were corrected: (1) local.CheckState objects were only shallow copied, but the key piece of data that gets read and updated is one of the things not copied (the underlying Check with a Status field). When the stock code was run with the race detector enabled this highly-relevant-to-the-test-scenario field was found to be racy. Changes: a) update the existing Clone method to include the Check field b) copy-on-write when those fields need to change rather than incrementally updating them in place. This made the observed behavior occur slightly less often. (2) If anything about how the runLocal method for node-local alias check logic was ever flawed, there was no fallback option. Those checks are purely edge-triggered and failure to properly notice a single edge transition would leave the alias check incorrect until the next flap of the aliased check. The change was to introduce a fallback timer to act as a control loop to double check the alias check matches the aliased check every minute (borrowing the duration from the non-local alias check logic body). This made the observed behavior eventually go away when it did occur. (3) Originally I thought there were two main actions involved in the data race: A. The act of adding the original check (from disk recovery) and its first health evaluation. B. The act of the HTTP API requests coming in and resetting the local state when re-registering the same services and checks. It took awhile for me to realize that there's a third action at work: C. The goroutines associated with the original check and the later checks. The actual sequence of actions that was causing the bad behavior was that the API actions result in the original check to be removed and re-added _without waiting for the original goroutine to terminate_. This means for brief windows of time during check definition edits there are two goroutines that can be sending updates for the alias check status. In extremely unlikely scenarios the original goroutine sees the aliased check start up in `critical` before being removed but does not get the notification about the nearly immediate update of that check to `passing`. This is interlaced wit the new goroutine coming up, initializing its base case to `passing` from the current state and then listening for new notifications of edge triggers. If the original goroutine "finishes" its update, it then commits one more write into the local state of `critical` and exits leaving the alias check no longer reflecting the underlying check. The correction here is to enforce that the old goroutines must terminate before spawning the new one for alias checks.	6 years ago
Freddy	6b31482333	Increase reliability of TestResetSessionTimerLocked_Renew	6 years ago
Pierre Souchay	e892981418	agent: Improve startup message to avoid confusing users when no error occurs (#5896) ... * Improve startup message to avoid confusing users when no error occurs Several times, some users not very familiar with Consul get confused by error message at startup: `[INFO] agent: (LAN) joined: 1 Err: <nil>` Having `Err: <nil>` seems weird to many users, I propose to have the following instead: * Success: `[INFO] agent: (LAN) joined: 1` * Error: `[WARN] agent: (LAN) couldn't join: %d Err: ERROR`	6 years ago
Freddy	17e74985b0	Run TestServer_Expect on its own (#5890)	6 years ago
Freddy	6c19cacd42	Flaky test: ACLReplication_Tokens (#5891) ... * Exclude non-go workflows while testing * Wait for s2 global-management policy * Revert "Exclude non-go workflows while testing" This reverts commit 47a83cbe9f.	6 years ago
Freddy	d4ea163b0b	Add retries to StatsFetcherTest (#5892)	6 years ago
Jack Pearkes	40cec98468	Release v1.5.1	6 years ago
freddygv	40b809bce3	Wait for s2 global-management policy	6 years ago
Freddy	e9259ca97a	Change log line used for verification	6 years ago
Freddy	d1c315fad9	Stop running TestLeader_ChangeServerID in parallel	6 years ago
Sarah Christoff	32b5992d0f	Add retries around `obj`	6 years ago
Sarah Christoff	73d73e0e20	Add retries to all `obj`	6 years ago
Sarah Christoff	2a018e5e0a	Update agent/coordinate_endpoint_test.go ... Co-Authored-By: Freddy <freddygv@users.noreply.github.com>	6 years ago
Sarah Christoff	b96d9b01bd	Update type assertion logic ... Logic updated to evaluate with a boolean after the type assertion. This allows us to check if the type assertion succeeded and be more clear with errors.	6 years ago
Kyle Havlovitz	31bb9d67df	Set the dead node reclaim timer at 30s	6 years ago
Kyle Havlovitz	29eb83c9c2	Merge branch 'master' into change-node-id	6 years ago
Jack Pearkes	34eff659dc	Release v1.5.0	6 years ago
Matt Keeler	dbc48ea3f7	Fixes race condition in Agent Cache (#5796) ... * Fix race condition during a cache get Check the entry we pulled out of the cache while holding the lock had Fetching set. If it did then we should use the existing Waiter instead of calling fetch. The reason this is better than just calling fetch is that fetch re-gets the entry out of the entries map and the previous fetch may have finished. Therefore this prevents erroneously starting a new fetch because we just missed the last update. * Fix race condition fully The first commit still allowed for the following scenario: • No entry existing when checked in getWithIndex while holding the read lock • Then by time we had reached fetch it had been created and finished. * always use ok when returning * comment mentioning the reading from entries. * use cacheHit consistently	6 years ago
Matt Keeler	dbf0a0f6c0	Copy the proxy config instead of direct assignment (#5786) ... This prevents modifying the data in the state store which is supposed to be immutable.	6 years ago
R.B. Boyer	20eefeea11	acl: a role binding rule for a role that does not exist should be ignored (#5778) ... I wrote the docs under this assumption but completely forgot to actually enforce it.	6 years ago
R.B. Boyer	b4371bcccd	acl: enforce that you cannot persist tokens and roles with missing links except during replication (#5779)	6 years ago
Matt Keeler	42d32db817	Fix ConfigEntryResponse binary marshaller and ensure we watch the chan in ConfigEntry.Get even when no entry exists. (#5773)	6 years ago
Paul Banks	6a58527cd8	Fix previous accidental master push 🤦 (#5771) ... * Fix previous accidental master push 🤦 * Fix ACL test	6 years ago
Paul Banks	6c81f9da0d	Fix panic in Resolving service config when proxy-defaults isn't defined yet (#5769)	6 years ago
Paul Banks	8f5b16ebaf	Fix uint8 conversion issues for service config response maps.	6 years ago
Paul Banks	0cfb6051ea	Add integration test for central config; fix central config WIP (#5752) ... * Add integration test for central config; fix central config WIP * Add integration test for central config; fix central config WIP * Set proxy protocol correctly and begin adding upstream support * Add upstreams to service config cache key and start new notify watcher if they change. This doesn't update the tests to pass though. * Fix some merging logic get things working manually with a hack (TODO fix properly) * Simplification to not allow enabling sidecars centrally - it makes no sense without upstreams anyway * Test compile again and obvious ones pass. Lots of failures locally not debugged yet but may be flakes. Pushing up to see what CI does * Fix up service manageer and API test failures * Remove the enable command since it no longer makes much sense without being able to turn on sidecar proxies centrally * Remove version.go hack - will make integration test fail until release * Remove unused code from commands and upstream merge * Re-bump version to 1.5.0	6 years ago
Matt Keeler	69f902608c	Update to use a consulent build tag instead of just ent (#5759)	6 years ago
Matt Keeler	3145bf5230	Centralized Config CLI (#5731) ... * Add HTTP endpoints for config entry management * Finish implementing decoding in the HTTP Config entry apply endpoint * Add CAS operation to the config entry apply endpoint Also use this for the bootstrapping and move the config entry decoding function into the structs package. * First pass at the API client for the config entries * Fixup some of the ConfigEntry APIs Return a singular response object instead of a list for the ConfigEntry.Get RPC. This gets plumbed through the HTTP API as well. Dont return QueryMeta in the JSON response for the config entry listing HTTP API. Instead just return a list of config entries. * Minor API client fixes * Attempt at some ConfigEntry api client tests These don’t currently work due to weak typing in JSON * Get some of the api client tests passing * Implement reflectwalk magic to correct JSON encoding a ProxyConfigEntry Also added a test for the HTTP endpoint that exposes the problem. However, since the test doesn’t actually do the JSON encode/decode its still failing. * Move MapWalk magic into a binary marshaller instead of JSON. * Add a MapWalk test * Get rid of unused func * Get rid of unused imports * Fixup some tests now that the decoding from msgpack coerces things into json compat types * Stub out most of the central config cli Fully implement the config read command. * Basic config delete command implementation * Implement config write command * Implement config list subcommand Not entirely sure about the output here. Its basically the read output indented with a line specifying the kind/name of each type which is also duplicated in the indented output. * Update command usage * Update some help usage formatting * Add the connect enable helper cli command * Update list command output * Rename the config entry API client methods. * Use renamed apis * Implement config write tests Stub the others with the noTabs tests. * Change list output format Now just simply output 1 line per named config * Add config read tests * Add invalid args write test. * Add config delete tests * Add config list tests * Add connect enable tests * Update some CLI commands to use CAS ops This also modifies the HTTP API for a write op to return a boolean indicating whether the value was written or not. * Fix up the HTTP API CAS tests as I realized they weren’t testing what they should. * Update config entry rpc tests to properly test CAS * Fix up a few more tests * Fix some tests that using ConfigEntries.Apply * Update config_write_test.go * Get rid of unused import	6 years ago
Matt Keeler	f665695b6b	Ensure ServiceName is populated correctly for agent service checks ... Also update some snapshot agent docs * Enforce correct permissions when registering a check Previously we had attempted to enforce service:write for a check associated with a service instead of node:write on the agent but due to how we decoded the health check from the request it would never do it properly. This commit fixes that. * Update website/source/docs/commands/snapshot/agent.html.markdown.erb Co-Authored-By: mkeeler <mkeeler@users.noreply.github.com>	6 years ago
Matt Keeler	d0f410cd84	Make a few config entry endpoints return 404s and allow for snake_case and lowercase key names. (#5748)	6 years ago
Freddy	44e3dd79ff	go fmt runtime_test.go	6 years ago
Freddy	d19eb36085	Restrict config file extensions read	6 years ago
Matt Keeler	4daa1585b0	ACL Token ID Initialization (#5307)	6 years ago
Paul Banks	a12810664f	Modify ConfigEntry bootstrapping syntax more generic (#5744) ... * Modify ConfigEntry bootstrapping syntax to be generic and compatible with other CLI config syntax. Refs #5743 * Fix gofmt issues.	6 years ago
Kyle Havlovitz	aba54cec55	Add HTTP endpoints for config entry management (#5718)	6 years ago
Paul Banks	421ecd32fc	Connect: allow configuring Envoy for L7 Observability (#5558) ... * Add support for HTTP proxy listeners * Add customizable bootstrap configuration options * Debug logging for xDS AuthZ * Add Envoy Integration test suite with basic test coverage * Add envoy command tests to cover new cases * Add tracing integration test * Add gRPC support WIP * Merged changes from master Docker. get CI integration to work with same Dockerfile now * Make docker build optional for integration * Enable integration tests again! * http2 and grpc integration tests and fixes * Fix up command config tests * Store all container logs as artifacts in circle on fail * Add retries to outer part of stats measurements as we keep missing them in CI * Only dump logs on failing cases * Fix typos from code review * Review tidying and make tests pass again * Add debug logs to exec test. * Fix legit test failure caused by upstream rename in envoy config * Attempt to reduce cases of bad TLS handshake in CI integration tests * bring up the right service * Add prometheus integration test * Add test for denied AuthZ both HTTP and TCP * Try ANSI term for Circle	6 years ago
R.B. Boyer	c6722fc43d	Merge pull request #5617 from hashicorp/f-acl-ux ... Secure ACL Introduction for Kubernetes	6 years ago
Aestek	21a776e202	Fix: fail messages after a node rename replace the new node definition (#5520) ... When receiving a serf faild message for a node which is not in the catalog, do not perform a register request to set is serf heath to critical as it could overwrite the node information and services if it was renamed. Fixes : #5518	6 years ago
R.B. Boyer	e47d7eeddb	acl: adding support for kubernetes auth provider login (#5600) ... * auth providers * binding rules * auth provider for kubernetes * login/logout	6 years ago
R.B. Boyer	cc1aa3f973	acl: adding Roles to Tokens (#5514) ... Roles are named and can express the same bundle of permissions that can currently be assigned to a Token (lists of Policies and Service Identities). The difference with a Role is that it not itself a bearer token, but just another entity that can be tied to a Token. This lets an operator potentially curate a set of smaller reusable Policies and compose them together into reusable Roles, rather than always exploding that same list of Policies on any Token that needs similar permissions. This also refactors the acl replication code to be semi-generic to avoid 3x copypasta.	6 years ago
R.B. Boyer	7928305279	making ACLToken.ExpirationTime a *time.Time value instead of time.Time (#5663) ... This is mainly to avoid having the API return "0001-01-01T00:00:00Z" as a value for the ExpirationTime field when it is not set. Unfortunately time.Time doesn't respect the json marshalling "omitempty" directive.	6 years ago
R.B. Boyer	db43fc3a20	acl: ACL Tokens can now be assigned an optional set of service identities (#5390) ... These act like a special cased version of a Policy Template for granting a token the privileges necessary to register a service and its connect proxy, and read upstreams from the catalog.	6 years ago
R.B. Boyer	2144bd7fbd	acl: tokens can be created with an optional expiration time (#5353)	6 years ago
Matt Keeler	15e80e4e76	Implement bootstrapping proxy defaults from the config file (#5714)	6 years ago
Matt Keeler	5befe0f5d5	Implement config entry replication (#5706)	6 years ago
Matt Keeler	222afeae4c	Move the watch package into the api module (#5664) ... * Move the watch package into the api module It was already just a thin wrapper around the API anyways. The biggest change was to the testing. Instead of using a test agent directly from the agent package it now uses the binary on the PATH just like the other API tests. The other big changes were to fix up the connect based watch tests so that we didn’t need to pull in the connect package (and therefore all of Consul)	6 years ago
Alvin Huang	8ceca2ace3	Add fmt and vet (#5671) ... * add go fmt and vet * go fmt fixes	6 years ago
Kyle Havlovitz	d8f8400fe1	Merge pull request #5700 from hashicorp/service-reg-manager ... Use centralized service config on agent service registrations	6 years ago
Kyle Havlovitz	43bfc20dc8	Test an index=0 value in cache.Notify	6 years ago
Freddy	f2213f60e0	Update alias checks on local add and remove	6 years ago
Aestek	f669bb7b0f	Add support for DNS config hot-reload (#4875) ... The DNS config parameters `recursors` and `dns_config.*` are now hot reloaded on SIGHUP or `consul reload` and do not need an agent restart to be modified. Config is stored in an atomic.Value and loaded at the beginning of each request. Reloading only affects requests that start _after_ the reload. Ongoing requests are not affected. To match the current behavior the recursor handler is loaded and unloaded as needed on config reload.	6 years ago
Kyle Havlovitz	cba47aa0ca	Fix a race in the ready logic	6 years ago
Kyle Havlovitz	c269369760	Make central service config opt-in and rework the initial registration	6 years ago
Kyle Havlovitz	b58572afbd	Fix a race in the service updates	6 years ago
Kyle Havlovitz	88e1d8ce03	Fill out the service manager functionality and fix tests	6 years ago
Kyle Havlovitz	7c25869e67	Add the service registration manager to the agent	6 years ago
Kyle Havlovitz	b186c3020c	Merge pull request #5615 from hashicorp/config-entry-rpc ... Add RPC endpoints for config entry operations	6 years ago
Kyle Havlovitz	fed7595d45	Rename config entry ACL methods	6 years ago
R.B. Boyer	6269d1f130	tests: actually have TestSessionTTLRenew sleep during execution (#5669) ... Due to an unintended order of operations issue with integer division TestSessionTTLRenew was sleeping for 0s every time. Also add explicit failures for when the various session renewal returns nil unexpectedly.	6 years ago
kaitlincarter-hc	7dcc727b4d	[docs] Server Performance (#5627) ... * Moving server performance guide to docs. * fixing broken links * updating broken link * fixing broken links	6 years ago
Freddy	eebc788959	Filter non-passing nodes without modifying cache	6 years ago
Matt Keeler	afa1cc98d1	Implement data filtering of some endpoints (#5579) ... Fixes: #4222 # Data Filtering This PR will implement filtering for the following endpoints: ## Supported HTTP Endpoints - `/agent/checks` - `/agent/services` - `/catalog/nodes` - `/catalog/service/:service` - `/catalog/connect/:service` - `/catalog/node/:node` - `/health/node/:node` - `/health/checks/:service` - `/health/service/:service` - `/health/connect/:service` - `/health/state/:state` - `/internal/ui/nodes` - `/internal/ui/services` More can be added going forward and any endpoint which is used to list some data is a good candidate. ## Usage When using the HTTP API a `filter` query parameter can be used to pass a filter expression to Consul. Filter Expressions take the general form of: ``` <selector> == <value> <selector> != <value> <value> in <selector> <value> not in <selector> <selector> contains <value> <selector> not contains <value> <selector> is empty <selector> is not empty not <other expression> <expression 1> and <expression 2> <expression 1> or <expression 2> ``` Normal boolean logic and precedence is supported. All of the actual filtering and evaluation logic is coming from the [go-bexpr](https://github.com/hashicorp/go-bexpr) library ## Other changes Adding the `Internal.ServiceDump` RPC endpoint. This will allow the UI to filter services better.	6 years ago
Freddy	b2c12550d7	Remove old UI, option to use it, and its build processes	6 years ago
Kyle Havlovitz	690e9dd2c0	Move the ACL logic into the ConfigEntry interface	6 years ago
Kyle Havlovitz	f2ed482680	Add RPC endpoints for config entry operations	6 years ago
Alvin Huang	f45e495e38	Merge pull request #5376 from hashicorp/fix-tests ... Fix tests in prep for CircleCI Migration	6 years ago
Kyle Havlovitz	5f569fb2ac	Merge pull request #5539 from hashicorp/service-config ... Service config state model	6 years ago
Kyle Havlovitz	a2fa9a0019	Cleaned up some error handling/comments around config entries	6 years ago
Kyle Havlovitz	c2da314eeb	Merge pull request #5553 from hashicorp/txn-check-serialization ... Use the correct check duration fields when converting transaction ops	6 years ago
Hans Hasselberg	ac45b17482	fix remaining CI failures after Go 1.12.1 Upgrade (#5576)	6 years ago
Kyle Havlovitz	d16be2e269	Encode config entry FSM messages in a generic type	6 years ago