consul

Tree: 78ad8203a4

Author	SHA1	Message	Date
PHBourquin	039615641e	Checks to passing/critical only after reaching a consecutive success/failure threshold (#5739 ) A check may be set to become passing/critical only if a specified number of successive checks return passing/critical in a row. Status will stay identical as before until the threshold is reached. This feature is available for HTTP, TCP, gRPC, Docker & Monitor checks.	5 years ago
Freddy	fdd10dd8b8	Expose HTTP-based paths through Connect proxy (#6446 ) Fixes: #5396 This PR adds a proxy configuration stanza called expose. These flags register listeners in Connect sidecar proxies to allow requests to specific HTTP paths from outside of the node. This allows services to protect themselves by only listening on the loopback interface, while still accepting traffic from non Connect-enabled services. Under expose there is a boolean checks flag that would automatically expose all registered HTTP and gRPC check paths. This stanza also accepts a paths list to expose individual paths. The primary use case for this functionality would be to expose paths for third parties like Prometheus or the kubelet. Listeners for requests to exposed paths are be configured dynamically at run time. Any time a proxy, or check can be registered, a listener can also be created. In this initial implementation requests to these paths are not authenticated/encrypted.	5 years ago
Christian Muehlhaeuser	16193665ca	Fixed a few tautological condition mistakes (#6177 ) None of these changes should have any side-effects. They're merely fixing tautological mistakes.	5 years ago
Sarah Adams	ea2bd5b728	http/tcp checks: fix long timeout behavior to default to user-configured value (#6094 ) Fixes #5834	5 years ago
Pierre Souchay	0e907f5aa8	Support for maximum size for Output of checks (#5233 ) * Support for maximum size for Output of checks This PR allows users to limit the size of output produced by checks at the agent and check level. When set at the agent level, it will limit the output for all checks monitored by the agent. When set at the check level, it can override the agent max for a specific check but only if it is lower than the agent max. Default value is 4k, and input must be at least 1.	5 years ago
R.B. Boyer	40336fd353	agent: fix several data races and bugs related to node-local alias checks (#5876 ) The observed bug was that a full restart of a consul datacenter (servers and clients) in conjunction with a restart of a connect-flavored application with bring-your-own-service-registration logic would very frequently cause the envoy sidecar service check to never reflect the aliased service. Over the course of investigation several bugs and unfortunate interactions were corrected: (1) local.CheckState objects were only shallow copied, but the key piece of data that gets read and updated is one of the things not copied (the underlying Check with a Status field). When the stock code was run with the race detector enabled this highly-relevant-to-the-test-scenario field was found to be racy. Changes: a) update the existing Clone method to include the Check field b) copy-on-write when those fields need to change rather than incrementally updating them in place. This made the observed behavior occur slightly less often. (2) If anything about how the runLocal method for node-local alias check logic was ever flawed, there was no fallback option. Those checks are purely edge-triggered and failure to properly notice a single edge transition would leave the alias check incorrect until the next flap of the aliased check. The change was to introduce a fallback timer to act as a control loop to double check the alias check matches the aliased check every minute (borrowing the duration from the non-local alias check logic body). This made the observed behavior eventually go away when it did occur. (3) Originally I thought there were two main actions involved in the data race: A. The act of adding the original check (from disk recovery) and its first health evaluation. B. The act of the HTTP API requests coming in and resetting the local state when re-registering the same services and checks. It took awhile for me to realize that there's a third action at work: C. The goroutines associated with the original check and the later checks. The actual sequence of actions that was causing the bad behavior was that the API actions result in the original check to be removed and re-added _without waiting for the original goroutine to terminate_. This means for brief windows of time during check definition edits there are two goroutines that can be sending updates for the alias check status. In extremely unlikely scenarios the original goroutine sees the aliased check start up in `critical` before being removed but does not get the notification about the nearly immediate update of that check to `passing`. This is interlaced wit the new goroutine coming up, initializing its base case to `passing` from the current state and then listening for new notifications of edge triggers. If the original goroutine "finishes" its update, it then commits one more write into the local state of `critical` and exits leaving the alias check no longer reflecting the underlying check. The correction here is to enforce that the old goroutines must terminate before spawning the new one for alias checks.	6 years ago
Jeff Mitchell	4243c3ae42	Move internal/ to sdk/ (#5568 ) * Move internal/ to sdk/ * Add a readme to the SDK folder	6 years ago
Jeff Mitchell	47c390025b	Convert to Go Modules (#5517 ) * First conversion * Use serf 0.8.2 tag and associated updated deps * * Move freeport and testutil into internal/ * Make internal/ its own module * Update imports * Add replace statements so API and normal Consul code are self-referencing for ease of development * Adapt to newer goe/values * Bump to new cleanhttp * Fix ban nonprintable chars test * Update lock bad args test The error message when the duration cannot be parsed changed in Go 1.12 (ae0c435877d3aacb9af5e706c40f9dddde5d3e67). This updates that test. * Update another test as well * Bump travis * Bump circleci * Bump go-discover and godo to get rid of launchpad dep * Bump dockerfile go version * fix tar command * Bump go-cleanhttp	6 years ago
Alvin Huang	6c9b516a29	skip TestCheckTCPPassing on CircleCI	6 years ago
Paul Banks	e812f5516a	Add -sidecar-for and new /agent/service/:service_id endpoint (#4691 ) - A new endpoint `/v1/agent/service/:service_id` which is a generic way to look up the service for a single instance. The primary value here is that it: - supports hash-based blocking and so; - replaces `/agent/connect/proxy/:proxy_id` as the mechanism the built-in proxy uses to read its config. - It's not proxy specific and so works for any service. - It has a temporary shim to call through to the existing endpoint to preserve current managed proxy config defaulting behaviour until that is removed entirely (tested). - The built-in proxy now uses the new endpoint exclusively for it's config - The built-in proxy now has a `-sidecar-for` flag that allows the service ID of the _target_ service to be specified, on the condition that there is exactly one "sidecar" proxy (that is one that has `Proxy.DestinationServiceID` set) for the service registered. - Several fixes for edge cases for SidecarService - A fix for `Alias` checks - when running locally they didn't update their state until some external thing updated the target. If the target service has no checks registered as below, then the alias never made it past critical.	6 years ago
Mitchell Hashimoto	9a90400821	agent/checks: prevent overflow of backoff	6 years ago
Mitchell Hashimoto	f97bfd5be8	agent: address some basic feedback	6 years ago
Mitchell Hashimoto	36e330941a	agent/checks: support node-only checks	6 years ago
Mitchell Hashimoto	1e9233eec1	agent/checks: set critical if RPC fails	6 years ago
Mitchell Hashimoto	e9914ee71c	agent/checks: use local state for local services	6 years ago
Mitchell Hashimoto	60c75b88da	agent/checks: reflect node failure as alias check failure	6 years ago
Mitchell Hashimoto	632e4a2c69	agent/checks: add Alias check type	6 years ago
Kieran Othen	e4b7465193	Update check.go Cosmetic fix to the agent's HTTP check function which always formats the result as "HTTP GET ...", ignoring any non-GET supplied HTTP method such as POST, PUT, etc.	7 years ago
Guido Iaquinti	8cd11d5888	Add package name to log output	7 years ago
James Phillips	64acd0ade0	Gets rid of named return parameters. This wasn't wrong before but we don't generally use this style in Consul.	7 years ago
James Phillips	b443bd1438	Moves non-stdlib includes into their own section.	7 years ago
Dmytro Kostiuchenko	1a10b08e82	Add gRPC health-check #3073	7 years ago
James Phillips	990fbbb86b	Cleans up check logging. There were places where we still didn't have the script vs. args sorted correctly so changed all the logging to be just based on check IDs and also made everything uniform. Also removed some annoying debug logging, and moved some of the large output logging to TRACE level. Closes #3602	7 years ago
James Phillips	cd935ebe6c	Adds missing os import.	7 years ago
James Phillips	8579225c27	Skips IPv6 test in Travis.	7 years ago
James Phillips	93f68555d0	Adds enable_agent_tls_for_checks configuration option which allows (#3661 ) HTTP health checks for services requiring 2-way TLS to be checked using the agent's credentials.	7 years ago
Preetha Appan	b15d8db851	Sets tty in docker client back to true, as a potential fix for docker exec weirdness	7 years ago
Frank Schroeder	c72e6bdb37	docker: fix failing test	7 years ago
Frank Schroeder	7c0e5036a8	docker: render errors with %v since they can be nil	7 years ago
Frank Schroeder	b4d8c26194	docker: add comment about "connection reset by peer" error	7 years ago
Frank Schroeder	e774b46f82	docker: close idle connections on stop	7 years ago
Frank Schroeder	94726ef105	docker: do not alloc a tty since this is not interactive	7 years ago
Frank Schroeder	a1b47d99c1	docker: make sure to log the error when we fall through	7 years ago
Frank Schroeder	51a18c2557	docker: ignore "connection reset by peer" The Docker agent closes the connection during read after we have read the body. This causes a "connection reset by peer" even though the command was successful. We ignore that error here since we got the correct status code and a response body.	7 years ago
Frank Schroeder	96fdbd00a6	replace custom unique id with a UUID	7 years ago
Frank Schroeder	8f145559d8	Decouple the code that executes checks from the agent	7 years ago

38 Commits (78ad8203a446c3cc079b5215d222883ddb8618bd)