2274 Commits (7fbddffdacb9bf817e41655246536ea643da5d21)

Author	SHA1	Message	Date
hc-github-team-consul-core	148a79fe93	Backport of [OSS] Fix initial_fetch_timeout to wait for all xDS resources into release/1.14.x (#18066) ... * fix(connect): set initial_fetch_time to wait indefinitely * changelog --------- Co-authored-by: DanStough <dan.stough@hashicorp.com>	1 year ago
hc-github-team-consul-core	fd5f1d5b63	Backport of watch: support -filter for consul watch: checks, services, nodes, service into release/1.14.x (#17985) ... * backport to 1.14.x --------- Co-authored-by: cskh <hui.kang@hashicorp.com>	1 year ago
Ashesh Vidyut	f4ea364258	[NET-3865] [Supportability] Additional Information in the output of 'consul operator raft list-peers' (#17582) (#17828) ... * init * fix tests * added -detailed in docs * added change log * fix doc * checking for entry in map * fix tests * removed detailed flag * removed detailed flag * revert unwanted changes * removed unwanted changes * updated change log * pr review comment changes * pr comment changes single API instead of two * fix change log * fix tests * fix tests * fix test operator raft endpoint test * Update .changelog/17582.txt * nits * updated docs --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
hc-github-team-consul-core	b1febc638d	Backport of [NET-4107][Supportability] Log Level set to TRACE and duration set to 5m for consul-debug into release/1.14.x (#17729) ... * backport of commit 9d72a262f3 * merged cherry picked commit --------- Co-authored-by: Ashesh Vidyut <ashesh.vidyut@hashicorp.com> Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>	1 year ago
hc-github-team-consul-core	92ac5ebcf1	fix: add agent info reporting log (#17660) ... Co-authored-by: Poonam Jadhav <poonam.jadhav@hashicorp.com>	1 year ago
Dan Stough	a2b41fd185	Revert "Backport of fix(connect envoy): set initial_fetch_timeout to wait for initial xDS into release/1.14 (#17372)" (#17541) ... This reverts commit 886c2efab5.	2 years ago
Dan Stough	886c2efab5	Backport of fix(connect envoy): set initial_fetch_timeout to wait for initial xDS into release/1.14 (#17372)	2 years ago
Hans Hasselberg	e26ac3f388	Update HCP bootstrapping to support existing clusters 1.14.x version (#17303) ... * Persist HCP management token from server config We want to move away from injecting an initial management token into Consul clusters linked to HCP. The reasoning is that by using a separate class of token we can have more flexibility in terms of allowing HCP's token to co-exist with the user's management token. Down the line we can also more easily adjust the permissions attached to HCP's token to limit it's scope. With these changes, the cloud management token is like the initial management token in that iit has the same global management policy and if it is created it effectively bootstraps the ACL system. * Update SDK and mock HCP server The HCP management token will now be sent in a special field rather than as Consul's "initial management" token configuration. This commit also updates the mock HCP server to more accurately reflect the behavior of the CCM backend. * Refactor HCP bootstrapping logic and add tests We want to allow users to link Consul clusters that already exist to HCP. Existing clusters need care when bootstrapped by HCP, since we do not want to do things like change ACL/TLS settings for a running cluster. Additional changes: * Deconstruct MaybeBootstrap so that it can be tested. The HCP Go SDK requires HTTPS to fetch a token from the Auth URL, even if the backend server is mocked. By pulling the hcp.Client creation out we can modify its TLS configuration in tests while keeping the secure behavior in production code. * Add light validation for data received/loaded. * Sanitize initial_management token from received config, since HCP will only ever use the CloudConfig.MangementToken. * Add changelog entry * pin logr * pin stdr --------- Co-authored-by: freddygv <freddy@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com>	2 years ago
Dan Stough	0448e51cf5	Manual Backport of [OSS] security: update go to 1.20.1 into release/1.14.x (#16321) ... * security: update go to 1.20.1 (#16263) * changelog	2 years ago
hc-github-team-consul-core	faaa2c11f0	command: Fix logger not initializing properly in envoy command (#16148) (#16153) ... Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	2 years ago
hc-github-team-consul-core	757aab81be	Add a flag for enabling debug logs to the `connect envoy` command (#15988) (#16121) ... * Add a flag for enabling debug logs to the `connect envoy` command * Update website/content/commands/connect/envoy.mdx * Add changelog note * Add debug log note to envoy proxy doc page * Update website/content/docs/connect/proxies/envoy.mdx * Wording tweak in envoy bootstrap section --------- Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Kendall Strautman <36613477+kendallstrautman@users.noreply.github.com>	2 years ago
Ashwin Venkatesh	085cb1a207	Add support for envoy readiness flags (#16015) (#16019) ... * Add support for envoy readiness flags - add flags 'envoy-ready-bind-port` and `envoy-ready-bind-addr` on consul connect envoy to create a ready listener on that address.	2 years ago
hc-github-team-consul-core	879e92f5ea	backport of commit f27c077de6 (#15934) ... Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>	2 years ago
hc-github-team-consul-core	7c0eec4c1f	Add support for configuring Envoys route idle_timeout (#14340) (#15611) ... * Add idleTimeout Co-authored-by: James Oulman <oulman@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
hc-github-team-consul-core	f4724e2e46	Backport of Fix issue with connect Envoy choosing incorrect TLS settings. into release/1.14.x (#15468) ... This pull request was automerged via backport-assistant	2 years ago
hc-github-team-consul-core	c896ae06bf	Backport of Bring back parameter ServerExternalAddresses in GenerateToken endpoint into release/1.14.x (#15296) ... * backport of commit 4199a7c30a * backport of commit 53be93fb90 * backport of commit 1b0ce4e96c * backport of commit 1b4ee792cb * backport of commit 98f3d5aa51 * backport of commit 1f3b30b768 * Fix gomod for merging. Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com> Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>	2 years ago
hc-github-team-consul-core	a71f0aa105	Backport of Allow consul debug on non-ACL consul servers into release/1.14.x (#15167) ... This pull request was automerged via backport-assistant	2 years ago
hc-github-team-consul-core	35fb3cb433	Backport of Update go version to 1.19 into release/1.14.x (#15139) ... This pull request was automerged via backport-assistant	2 years ago
hc-github-team-consul-core	1ce2c68cee	backport of commit 2fe633bf44 (#15096) ... This pull request was automerged via backport-assistant	2 years ago
Curt Bushko	161273a931	Update command/connect/envoy/bootstrap_tpl.go ... Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Curt Bushko	cd185c4c2c	update prometheus template args	2 years ago
Nitya Dhanushkodi	5e156772f6	Remove ability to specify external addresses in GenerateToken endpoint (#14930) ... * Reverts "update generate token endpoint to take external addresses (#13844)" This reverts commit f47319b7c6.	2 years ago
Iryna Shustava	5cd0ccfc75	Support auth method with snapshot agent [ENT] (#15020) ... Port of hashicorp/consul-enterprise#3303	2 years ago
Iryna Shustava	4bc4ef135c	cli: Add -node-name flag to redirect-traffic command (#14933)	2 years ago
cskh	eb26a7dee9	fix(cli): missing error message (#14959)	2 years ago
Chris S. Kim	b0a4c5c563	Include stream-related information in peering endpoints	2 years ago
freddygv	fac3ddc857	Use internal server certificate for peering TLS ... A previous commit introduced an internally-managed server certificate to use for peering-related purposes. Now the peering token has been updated to match that behavior: - The server name matches the structure of the server cert - The CA PEMs correspond to the Connect CA Note that if Conect is disabled, and by extension the Connect CA, we fall back to the previous behavior of returning the manually configured certs and local server SNI. Several tests were updated to use the gRPC TLS port since they enable Connect by default. This means that the peering token will embed the Connect CA, and the dialer will expect a TLS listener.	2 years ago
Eric Haberkorn	1b565444be	Rename `PeerName` to `Peer` on prepared queries and exported services (#14854)	2 years ago
Eric Haberkorn	80e51ff907	Add exported services event to cluster peering replication. (#14797)	2 years ago
Nick Ethier	1c1b0994b8	add HCP integration component (#14723) ... * add HCP integration * lint: use non-deprecated logging interface	2 years ago
DanStough	2a2debee64	feat(peering): validate server name conflicts on establish	2 years ago
Chris S. Kim	7370f0a953	Fix test ordering (#14543)	2 years ago
Derek Menteer	bf769daae4	Merge branch 'main' of github.com:hashicorp/consul into derekm/split-grpc-ports	2 years ago
Derek Menteer	f64771c707	Address PR comments.	2 years ago
DanStough	e617e7df3e	feat(cli): add initial peering cli commands	2 years ago
Derek Menteer	1255a8a20d	Add separate grpc_tls port. ... To ease the transition for users, the original gRPC port can still operate in a deprecated mode as either plain-text or TLS mode. This behavior should be removed in a future release whenever we no longer support this. The resulting behavior from this commit is: `ports.grpc > 0 && ports.grpc_tls > 0` spawns both plain-text and tls ports. `ports.grpc > 0 && grpc.tls == undefined` spawns a single plain-text port. `ports.grpc > 0 && grpc.tls != undefined` spawns a single tls port (backwards compat mode).	2 years ago
Dao Thanh Tung	fead3c537b	Fix Consul KV CLI 'GET' flags 'keys' and 'recurse' to be set together (#13493) ... allow flags -recurse and -keys to be run at the same time in consul kv get CLI	2 years ago
Jared Kirschner	1200e83c3b	Merge pull request #14034 from hashicorp/make-proxy-sidecar-for-case-insensitive ... Allow uppercase in proxy launch -sidecar-for arg	2 years ago
Daniel Upton	6e0de48e60	cli: update agent log preamble to reflect per-listener TLS config	2 years ago
Jared Kirschner	22511ec491	Allow uppercase in proxy launch -sidecar-for arg ... Previously, when launching a sidecar proxy with one of the following commands: - consul connect envoy -sidecar-for=... - consul connect proxy -sidecar-for=... ... the -sidecar-for argument could only contain lowercase letters, even if the service was registered with some uppercase letters. Now, the -sidecar-for argument is treated as case-insensitive.	2 years ago
cskh	155c4bc2af	fix(cli): error message in service deregister subcommand (#14028)	2 years ago
cskh	6640997fc1	fix (cli): import empty directory to kv (#13939) ... * fix (cli): import empty directory to kv - when import an empty directory like foo/, the import command will remove the trailing /, making it a non-directory key. - This change fixes the bug by adding back the / if the imported key is an directory	2 years ago
Chris S. Kim	8ed49ea4d0	Update envoy metrics label extraction for peered clusters and listeners (#13818) ... Now that peered upstreams can generate envoy resources (#13758), we need a way to disambiguate local from peered resources in our metrics. The key difference is that datacenter and partition will be replaced with peer, since in the context of peered resources partition is ambiguous (could refer to the partition in a remote cluster or one that exists locally). The partition and datacenter of the proxy will always be that of the source service. Regexes were updated to make emitting datacenter and partition labels mutually exclusive with peer labels. Listener filter names were updated to better match the existing regex. Cluster names assigned to peered upstreams were updated to be synthesized from local peer name (it previously used the externally provided primary SNI, which contained the peer name from the other side of the peering). Integration tests were updated to assert for the new peer labels.	2 years ago
DanStough	2da8949d78	feat: convert destination address to slice	2 years ago
Paul Glass	77afe0e76e	Extract AWS auth implementation out of Consul (#13760)	2 years ago
Jared Kirschner	067272b53f	Merge pull request #13787 from hashicorp/fix-acl-read-token-self-expanded-panic ... Fix panic on acl token read with -self and -expanded	2 years ago
Jared Kirschner	927033e672	Fix panic on acl token read with -self and -expanded	2 years ago
cskh	cf6b6dddaf	feat(cli): enable to delete config entry from an input file (#13677) ... * feat(cli): enable to delete config entry from an input file - A new flag to config delete to delete a config entry in a valid config file, e.g., config delete -filename intention-allow.hcl - Updated flag validation; -filename and -kind can't be set at the same time - Move decode config entry method from config_write.go to helpers.go for reusing ParseConfigEntry() - add changelog Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
Kyle Havlovitz	407e858389	Fix syntax for bootstrap sds secret config	2 years ago
R.B. Boyer	31b95c747b	xds: modify rbac rules to use the XFCC header for peered L7 enforcement (#13629) ... When the protocol is http-like, and an intention has a peered source then the normal RBAC mTLS SAN field check is replaces with a joint combo of: mTLS SAN field must be the service's local mesh gateway leaf cert AND the first XFCC header (from the MGW) must have a URI field that matches the original intention source Also: - Update the regex program limit to be much higher than the teeny defaults, since the RBAC regex constructions are more complicated now. - Fix a few stray panics in xds generation.	2 years ago