consul

Commit Graph

Author	SHA1	Message	Date
Nitya Dhanushkodi	ed738a6f98	fix: use Envoy's default for validate_clusters to fix breaking routes when some backend clusters don't exist (#21587 )	3 months ago
Chris S. Kim	b6f10bc58f	Skip filter chain created by permissive mtls (#20406 )	10 months ago
John Murret	2f335113f8	NET-6943 - Replace usage of deprecated Envoy field envoy.config.router.v3.WeightedCluster.total_weight. (#20011 )	11 months ago
John Murret	74daaa5043	XDS V1 should not make runs for TCP Disco Chains. (#19496 ) * XDS V1 should not make runs for TCP Disco Chains. * update TestEnvoyExtenderWithSnapshot	1 year ago
Thomas Eckert	342306c312	Allow connections through Terminating Gateways from peered clusters NET-3463 (#18959 ) * Add InboundPeerTrustBundle maps to Terminating Gateway * Add notify and cancelation of watch for inbound peer trust bundles * Pass peer trust bundles to the RBAC creation function * Regenerate Golden Files * add changelog, also adds another spot that needed peeredTrustBundles * Add basic test for terminating gateway with peer trust bundle * Add intention to cluster peered golden test * rerun codegen * update changelog * really update the changelog --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>	1 year ago
Chris Thain	4724a4e169	Add Envoy golden test for OTEL access logging extension (#18760 )	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707 )	1 year ago
Chris S. Kim	50a9d1b696	Remove POC code (#17974 )	1 year ago
Eric Haberkorn	779647b948	Add Envoy and Consul version constraints to Envoy extensions (#17612 )	1 year ago
Michael Zalimeni	ad03a5d0f2	Avoid panic applying TProxy Envoy extensions (#17537 ) When UpstreamEnvoyExtender was introduced, some code was left duplicated between it and BasicEnvoyExtender. One path in that code panics when a TProxy listener patch is attempted due to no upstream data in RuntimeConfig matching the local service (which would only happen in rare cases). Instead, we can remove the special handling of upstream VIPs from BasicEnvoyExtender entirely, greatly simplifying the listener filter patch code and avoiding the panic. UpstreamEnvoyExtender, which needs this code to function, is modified to ensure a panic does not occur. This also fixes a second regression in which the Lua extension was not applied to TProxy outbound listeners.	2 years ago
Eric Haberkorn	d99312b86e	Add Upstream Service Targeting to Property Override Extension (#17517 ) * add upstream service targeting to property override extension * Also add baseline goldens for service specific property override extension. * Refactor the extension framework to put more logic into the templates. * fix up the golden tests	2 years ago
Chris Thain	65b8ccdc1b	Enable Network filters for Wasm Envoy Extension (#17505 )	2 years ago
Michael Zalimeni	e1df0f28bd	Support `Listener` and `ClusterLoadAssignment` in `property-override` (#17497 ) * Support Listener in Property Override Add support for patching `Listener` resources via the builtin `property-override` extension. Refactor existing listener patch code in `BasicEnvoyExtender` to simplify addition of resource support. * Support ClusterLoadAssignment in Property Override Add support for patching `ClusterLoadAssignment` resources via the builtin `property-override` extension.	2 years ago
Michael Zalimeni	5a46a8c604	Add `builtin/property-override` Envoy Extension (#17487 ) `property-override` is an extension that allows for arbitrarily patching Envoy resources based on resource matching filters. Patch operations resemble a subset of the JSON Patch spec with minor differences to facilitate patching pre-defined (protobuf) schemas. See Envoy Extension product documentation for more details. Co-authored-by: Eric Haberkorn <eric.haberkorn@hashicorp.com> Co-authored-by: Kyle Havlovitz <kyle@hashicorp.com>	2 years ago
Chris Thain	516eb4febc	Add `builtin/ext-authz` Envoy Extension (#17495 )	2 years ago
Michael Zalimeni	b8d2640429	Disable remote proxy patching except AWS Lambda (#17415 ) To avoid unintended tampering with remote downstreams via service config, refactor BasicEnvoyExtender and RuntimeConfig to disallow typical Envoy extensions from being applied to non-local proxies. Continue to allow this behavior for AWS Lambda and the read-only Validate builtin extensions. Addresses CVE-2023-2816.	2 years ago
Chris Thain	175bb1a303	Wasm Envoy HTTP extension (#16877 )	2 years ago
cskh	e91bc9c058	feat: envoy extension - http local rate limit (#16196 ) - http local rate limit - Apply rate limit only to local_app - unit test and integ test	2 years ago
Derek Menteer	06338c8ee7	Add unit test and update golden files. (#16115 )	2 years ago
Nitya Dhanushkodi	8728a4496c	troubleshoot: service to service validation (#16096 ) * Add Tproxy support to Envoy Extensions (this is needed for service to service validation) * Add validation for Envoy configuration for an upstream service * Use both /config_dump and /cluster to validate Envoy configuration This is because of a bug in Envoy where the EndpointsConfigDump does not include a cluster_name, making it impossible to match an endpoint to verify it exists. This removes endpoints support for builtin extensions since only the validate plugin was using it, and it is no longer used. It also removes test cases for endpoint validation. Endpoints validation now only occurs in the top level test from config_dump and clusters json files. Co-authored-by: Eric <eric@haberkorn.co>	2 years ago
Eric Haberkorn	8d923c1789	Add the Lua Envoy extension (#15906 )	2 years ago

21 Commits (888e302f6e87f27d0c8a0c6facfd6c3a6c8033c5)