consul

Commit Graph

Author	SHA1	Message	Date
R.B. Boyer	74d5df7c7a	xds: use envoy's rbac filter to handle intentions entirely within envoy (#8569 )	4 years ago
R.B. Boyer	462f0f37ed	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194 ) Highlights: - add new endpoint to query for intentions by exact match - using this endpoint from the CLI instead of the dump+filter approach - enforcing that OSS can only read/write intentions with a SourceNS or DestinationNS field of "default". - preexisting OSS intentions with now-invalid namespace fields will delete those intentions on initial election or for wildcard namespaces an attempt will be made to downgrade them to "default" unless one exists. - also allow the '-namespace' CLI arg on all of the intention subcommands - update lots of docs	4 years ago
Daniel Nephin	ce6cc094a1	intentions: fix a bug in Intention.SetHash Found using staticcheck. binary.Write does not accept int types without a size. The error from binary.Write was ignored, so we never saw this error. Casting the data to uint64 produces a correct hash. Also deprecate the Default{Addr,Port} fields, and prevent them from being encoded. These fields will always be empty and are not used. Removing these would break backwards compatibility, so they are left in place for now. Co-authored-by: Hans Hasselberg <me@hans.io>	5 years ago
Jono Sosulska	c554ba9e10	Replace whitelist/blacklist terminology with allowlist/denylist (#7971 ) * Replace whitelist/blacklist terminology with allowlist/denylist	5 years ago
Daniel Nephin	c88fae0aac	ci: Add staticcheck and fix most errors Three of the checks are temporarily disabled to limit the size of the diff, and allow us to enable all the other checks in CI. In a follow up we can fix the issues reported by the other checks one at a time, and enable them.	5 years ago
Matt Keeler	0e7d3d93b3	Enable filtering language support for the v1/connect/intentions… (#7593 ) * Enable filtering language support for the v1/connect/intentions listing API * Update website for filtering of Intentions * Update website/source/api/connect/intentions.html.md	5 years ago
Matt Keeler	8bd34e126f	Intentions ACL enforcement updates (#7028 ) * Renamed structs.IntentionWildcard to structs.WildcardSpecifier * Refactor ACL Config Get rid of remnants of enterprise only renaming. Add a WildcardName field for specifying what string should be used to indicate a wildcard. * Add wildcard support in the ACL package For read operations they can call anyAllowed to determine if any read access to the given resource would be granted. For write operations they can call allAllowed to ensure that write access is granted to everything. * Make v1/agent/connect/authorize namespace aware * Update intention ACL enforcement This also changes how intention:read is granted. Before the Intention.List RPC would allow viewing an intention if the token had intention:read on the destination. However Intention.Match allowed viewing if access was allowed for either the source or dest side. Now Intention.List and Intention.Get fall in line with Intention.Matches previous behavior. Due to this being done a few different places ACL enforcement for a singular intention is now done with the CanRead and CanWrite methods on the intention itself. * Refactor Intention.Apply to make things easier to follow.	5 years ago
Matt Keeler	a704ebe639	Add Namespace support to the API module and the CLI commands (#6874 ) Also update the Docs and fixup the HTTP API to return proper errors when someone attempts to use Namespaces with an OSS agent. Add Namespace HTTP API docs Make all API endpoints disallow unknown fields	5 years ago
Sarah Adams	78ad8203a4	Use encoding/json as JSON decoder instead of mapstructure (#6680 ) Fixes #6147	5 years ago
Matt Keeler	4bc1277315	Include a content hash of the intention for use during replication	5 years ago
Kyle Havlovitz	819566f6b7	fsm: add Intention operations to transactions for internal use	6 years ago
Paul Banks	4a54f8f7e3	Fix some tests failures caused by the sorting change and some cuased by previous UpdatePrecedence() change	7 years ago
Mitchell Hashimoto	028aa78e83	agent/consul: set precedence value on struct itself	7 years ago
Mitchell Hashimoto	0accfc1628	agent: rename test to check	7 years ago
Mitchell Hashimoto	d68462fca6	agent/consul: implement Intention.Test endpoint	7 years ago
Mitchell Hashimoto	bd3b8e042a	agent/cache: address PR feedback, lots of typos	7 years ago
Mitchell Hashimoto	0f3f3d13ca	agent/cache-types: support intention match queries	7 years ago
Paul Banks	ed9f07c361	Allow duplicate source or destination, but enforce uniqueness across all four.	7 years ago
Mitchell Hashimoto	6dc2db94ea	agent/structs: String format for Intention, used for logging	7 years ago
Mitchell Hashimoto	a67ff1c0dc	agent/consul: Basic ACL on Intention.Apply	7 years ago
Mitchell Hashimoto	ab4ea3efb4	agent/consul: set default intention SourceType, validate it	7 years ago
Mitchell Hashimoto	d92993f75b	agent/structs: Intention validation	7 years ago
Mitchell Hashimoto	82a50245e0	agent/consul: support intention description, meta is non-nil	7 years ago
Mitchell Hashimoto	a9743f4f15	agent,agent/consul: set default namespaces	7 years ago
Mitchell Hashimoto	93de03fe8b	agent/consul: RPC endpoint for Intention.Match	7 years ago
Mitchell Hashimoto	377479c01a	agent/structs: IntentionPrecedenceSorter for sorting based on precedence	7 years ago
Mitchell Hashimoto	274bfdd864	agent: POST /v1/connect/intentions	7 years ago
Mitchell Hashimoto	e8c4156f07	agent/consul: Intention.Get endpoint	7 years ago
Mitchell Hashimoto	9e307e178e	agent/consul: Intention.Apply, FSM methods, very little validation	7 years ago
Mitchell Hashimoto	212a272989	agent/consul: start Intention RPC endpoints, starting with List	7 years ago
Mitchell Hashimoto	cc8a6f7f15	agent/consul/state: initial work on intentions memdb table	7 years ago

31 Commits (7b4aca2088c441c427c0acb5b97ca07790cb46f6)