consul

Commit Graph

Author	SHA1	Message	Date
freddygv	cc5a7ed36c	Avoid returning empty roots with uninitialized CA Currently getCARoots could return an empty object with an empty trust domain before the CA is initialized. This commit returns an error while there is no CA config or no trust domain. There could be a CA config and no trust domain because the CA config can be created in InitializeCA before initialization succeeds.	3 years ago
Dhia Ayachi	7916268c40	refactor session state store tables to use the new index pattern (#11525 ) * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused func `prefixIndexFromServiceNameAsString` * fix test error check * remove unused operations_ent.go and operations_oss.go func * remove unused const Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dhia Ayachi	98735a6d12	KV refactoring, part 2 (#11512 ) * add partition to the kv get pretty print * fix failing test * add test for kvs RPC endpoint	3 years ago
Karl Cardenas	855925cd46	docs: removed broken link to Ambassador	3 years ago
Dhia Ayachi	520cb5858c	KV state store refactoring and partitioning (#11510 ) * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * partition kvs indexID table * add `partitionedIndexEntryName` in oss for test purpose * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * remove entmeta reference from oss Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Freddy	5e7eb85f2a	Fix caveat about resolvers operating at L4 (#11497 ) Service resolvers can specify L4 rules such as redirects, or L7 rules such as hash-based load balancing policies.	3 years ago
David Yu	6defa9ddb8	docs: add `brew install hashicorp/tap/consul-k8s` and re-order install and uninstall workflows (#11489 ) * docs: add `brew install hashicorp/tap/consul-k8s` * add consul k8s cli brew install to reference * Update k8s-cli.mdx * split home-brew commands into two steps * Update k8s-cli.mdx * slight changes on recommended way of installing Consul K8s for CLI or multi-DC * Update install.mdx * reorder cli and helm uninstall * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/k8s-cli.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/k8s-cli.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Daniel Nephin	d9110136f2	ca: Only initialize clusterID in the primary The secondary must get the clusterID from the primary	3 years ago
Daniel Nephin	01bd3d118d	ca: return an error when secondary fails to initialize Previously secondaryInitialize would return nil in this case, which prevented the deferred initialize from happening, and left the CA in an uninitialized state until a config update or root rotation. To fix this I extracted the common parts into the delegate implementation. However looking at this again, it seems like the handling in secondaryUpdateRoots is impossible, because that function should never be called before the secondary is initialzied. I beleive we can remove some of that logic in a follow up.	3 years ago
R.B. Boyer	d110d8735f	update changelog (#11513 )	3 years ago
Evan Culver	01c583431a	ci: Loosen apt source verification (#11493 )	3 years ago
Daniel Nephin	4e4439a2b2	Merge pull request #11415 from hashicorp/dnephin/acl-policy-id-and-revision acl: remove Policy.ID and Policy.Revision	3 years ago
Daniel Nephin	8ba760a2fc	acl: remove id and revision from Policy constructors The fields were removed in a previous commit. Also remove an unused constructor for PolicyMerger	3 years ago
Daniel Nephin	7c679c11e6	acl: remove Policy.ID and Policy.Revision These two fields do not appear to be used anywhere. We use the structs.ACLPolicy ID in the ACLResolver cache, but the acl.Policy ID and revision are not used.	3 years ago
R.B. Boyer	c7c5013edd	rename helper method to reflect the non-deprecated terminology (#11509 )	3 years ago
Luke Kysow	5caee36a76	Document default storage class requirements (#11492 )	3 years ago
Kenia	4c2fa322a1	ui: Topology view with no dependencies (#11280 )	3 years ago
Connor	efe4b21287	Support Vault Namespaces explicitly in CA config (#11477 ) * Support Vault Namespaces explicitly in CA config If there is a Namespace entry included in the Vault CA configuration, set it as the Vault Namespace on the Vault client Currently the only way to support Vault namespaces in the Consul CA config is by doing one of the following: 1) Set the VAULT_NAMESPACE environment variable which will be picked up by the Vault API client 2) Prefix all Vault paths with the namespace Neither of these are super pleasant. The first requires direct access and modification to the Consul runtime environment. It's possible and expected, not super pleasant. The second requires more indepth knowledge of Vault and how it uses Namespaces and could be confusing for anyone without that context. It also infers that it is not supported * Add changelog * Remove fmt.Fprint calls * Make comment clearer * Add next consul version to website docs * Add new test for default configuration * go mod tidy * Add skip if vault not present * Tweak changelog text	3 years ago
trujillo-adam	b4abd242e8	applied feedback	3 years ago
FFMMM	fdb0ee6093	change vault ca docs to mention root cert ttl config (#11488 ) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
R.B. Boyer	44c023a302	segments: ensure that the serf_lan_allowed_cidrs applies to network segments (#11495 )	3 years ago
R.B. Boyer	e9ca2e091e	add changelog entry (#11494 )	3 years ago
Mark Anderson	7e8228a20b	Remove some usage of md5 from the system (#11491 ) * Remove some usage of md5 from the system OSS side of https://github.com/hashicorp/consul-enterprise/pull/1253 This is a potential security issue because an attacker could conceivably manipulate inputs to cause persistence files to collide, effectively deleting the persistence file for one of the colliding elements. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
FFMMM	61bd417a82	plumb thru root cert tll to the aws ca provider (#11449 ) * plumb thru root cert ttl to the aws ca provider Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11449.txt Co-authored-by: Dhia Ayachi <dhia@hashicorp.com> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	3 years ago
John Cowen	25961355c1	ui: Only show partition / partition selector if enabled (#11484 ) I missed that partitions should never display if you can't use them, not just if you can't choose them.	3 years ago
John Cowen	72be2dd204	ui: Ensure we check intention service prefix permissions for per service (#11409 ) Port of: Ensure we check intention service prefix permissions for per service (#11270) Previously, when showing some action buttons for 'per service intentions' we used a global 'can I do something with any intention' permission to decide whether to show a certain button or not. If a user has a token that does not have 'global' intention permissions, but does have intention permissions on one or more specific services (for example via service / service_prefix), this meant that we did not show them certain buttons required to create/edit the intentions for this specific service. This PR adds that extra permissions check so we now check the intentions permissions per service instead of using the 'global' "can I edit intentions" question/request. Notes: - If a HTML button is `disabled` this means tippy.js doesn't adopt the popover properly and subsequently hide it from the user, so aswell as just disabling the button so you can't active the popover, we also don't even put the popover on the page - If `ability.item` or `ability.item.Resources` are empty then assume no access We don't try to disable service > right hand side intention actions here Whether you can create intentions for a service depends on the _destination_ of the intention you would like to create. For the topology view going from the LHS to the center, this is straightforwards as we only need to know the permissions for the central service, as when you are going from the LHS to the center, the center is the _destination_. When going from the center to the RHS the _destination[s]_ are on the RHS. This means we need to know the permissions for potentially 1000s of services all in one go in order to know when to show a button or not. We can't realistically discover the permissions for service > RHS services as we'd have either make a HTTP request per right hand service, or potentially make an incredibly large POST request for all the potentially 1000s of services on the right hand side (more preferable to 1000s of HTTP requests). Therefore for the moment at least we keep the old functionality (thin client) for the middle to RHS here. If you do go to click on the button and you don't have permissions to update the intention you will still not be able to update it, only you won't know this until you click the button (at which point you'll get a UI visible 403 error) Note: We reversed the conditional here between 1.10 and 1.11 So this make 100% sense that the port is different here to 1.11	3 years ago
David Yu	8f8055352d	docs: consul-k8s uninstall with namespace (#11478 ) * docs: consul-k8s uninstall with namespace Uninstall with namespace * change release name to consul in uninstall * Update website/content/docs/k8s/operations/uninstall.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * add --create-namespace command to install for custom values file Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
trujillo-adam	e09744adde	changed 'segments' in this page to 'resource labels' to disambiguate from 'network segments'	3 years ago
Kevin Wang	7e80484013	chore: react-subnav (#11486 )	3 years ago
Daniel Nephin	7ed6e3b790	Merge pull request #10822 from hashicorp/krarey/patch-replication-policy Update namespaced replication token example	3 years ago
Kyle Rarey	a775e9a274	Update namespaced replication token example	3 years ago
FFMMM	6004a21f35	fix aws pca certs (#11470 ) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
99	6b6557cb2b	Add rpm signing workflow	3 years ago
Thomas Eckert	875fa920c9	Update Helm Docs for v0.36.0 Consul K8s release (#11483 ) Co-authored-by: David Yu <dyu@hashicorp.com>	3 years ago
Luke Kysow	9b680b3f81	Add quick-link for users coming from UI (#11403 ) The Consul UI topology view has an icon with the text "Configure metrics dashboard" that links to this page. Add a notice at the top of the page that links them directly to the relevant section.	3 years ago
Luke Kysow	c61208146d	Use "Open dashboard" everywhere (#11406 ) Previously we had "Open metrics Dashboard" and "Configure metrics dashboard" in the topology cards and then we had "Open Dashboard" in the top nav when the dashboard was configured. Now we use "Open dashboard" and "Configure dashboard". This change was made for consistency in wording and casing. In addition, the dashboard could be used for metrics but also other dashboards so there's no need to scope it only to metrics. Also the config is: ```hcl ui_config { dashboard_url_templates } ``` Which does not mention metrics	3 years ago
Mathew Estafanous	8fb90aacef	Convert (some) test endpoints to use ServeHTTP instead of direct calls to handlers. (#11445 )	3 years ago
trujillo-adam	3ffa05495e	Merge pull request #11307 from hashicorp/docs/admin-partitions-cli-v1.11.0 admin partition docs part 1 - cli	3 years ago
Luke Kysow	7eb32cdb73	Remove Name/Namespace fields from upstream default (#11456 ) The UpstreamConfig.Defaults field does not support setting Name or Namespace because the purpose is to apply defaults to all upstreams. I think this was just missed in the docs since those fields would error if set under Defaults. i.e. this is not supported: ``` UpstreamConfig { Defaults { Name = "foo" Namespace = "bar" # Defaults config here } } ```	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428 ) * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Daniel Nephin	51d8417545	Merge pull request #10690 from tarat44/h2c-support-in-ping-checks add support for h2c in h2 ping health checks	3 years ago
Freddy	39023fb296	Prevent running build workflows on all PRs (#11469 )	3 years ago
Alessandro De Blasis	2238df6fa4	changelog Signed-off-by: Alessandro De Blasis <alex@deblasis.net>	3 years ago
Alessandro De Blasis	2f970555d9	config: warn the user if client_addr is empty if the provided value is empty string then the client services (DNS, HTTP, HTTPS, GRPC) are not listening and the user is not notified in any way about what's happening. Also, since a not provided client_addr defaults to 127.0.0.1, we make sure we are not getting unwanted warnings Signed-off-by: Alessandro De Blasis <alex@deblasis.net>	3 years ago
Daniel Nephin	b57cae94de	Merge pull request #10771 from hashicorp/dnephin/emit-telemetry-metrics-immediately telemetry: improve cert expiry metrics	3 years ago
Freddy	3f30afd26b	Merge pull request #11450 from hashicorp/ap/best-addr Ensure calls to BestAddress consider partition	3 years ago
freddygv	60066e5154	Exclude default partition from GatewayKey string This will behave the way we handle SNI and SPIFFE IDs, where the default partition is excluded. Excluding the default ensures that don't attempt to compare default.dc2 to dc2 in OSS.	3 years ago
freddygv	e3666b0bc4	Update GatewayKeys deduplication Federation states data is only keyed on datacenter, so it cannot be directly compared against keys for gateway groups.	3 years ago
freddygv	90ce897456	Store GatewayKey in proxycfg snapshot for re-use	3 years ago
freddygv	bbe46e9522	Update locality check in xds	3 years ago

1 2 3 4 5 ...

15781 Commits (86a30e9ce777014b2a8df889b41aea8c90d73262) All Branches Search

15781 Commits (86a30e9ce777014b2a8df889b41aea8c90d73262)

All Branches