consul

Commit Graph

Author	SHA1	Message	Date
Chris Thain	516eb4febc	Add `builtin/ext-authz` Envoy Extension (#17495 )	2 years ago
Chris Thain	2740d12d44	ENT->OSS merge for Consolidate `ListEnvoyExtender` into `BasicEnvoyExtender` (#17491 )	2 years ago
Lincoln Stoll	3605fde865	perf: Remove expensive reflection from raft/mesh hot path (#16552 ) * perf: Remove expensive reflection from raft/mesh hot path Replaces a reflection-based copy of a struct in the mesh topology with a deep-copy generated implementation. This is in the hot-path of raft FSM updates, and the reflection overhead was a substantial part of mesh registration times (~90%). This could manifest as raft thread saturation, and resulting instability. Co-authored-by: Joel Brandhorst <joel.brandhorst@gmail.com> * add changelog --------- Co-authored-by: Joel Brandhorst <joel.brandhorst@gmail.com> Co-authored-by: John Murret <john.murret@hashicorp.com>	2 years ago
John Murret	7177aadbf2	ci: update backport assistant to 0.3.4 (#17486 )	2 years ago
Luke Kysow	720dda7d70	Update index.mdx (#17477 )	2 years ago
Hans Hasselberg	c7bb36559e	add docs for consul-k8s config read command (#17461 ) * add docs for consul-k8s config read command This PR adds documentation for the functionality introduced in https://github.com/hashicorp/consul-k8s/pull/2078. * add output --------- Co-authored-by: David Yu <dyu@hashicorp.com>	2 years ago
Eric Haberkorn	17a280d51b	This fixes an issue where TCP services that are exported cannot be configured to failover. (#17469 ) This will likely happen frequently with sameness groups. Relaxing this constraint is harmless for failover because xds/endpoints exludes cross partition and peer endpoints.	2 years ago
Eric Haberkorn	1c80892717	fix tproxy sameness groups (#17468 )	2 years ago
Luke Kysow	9327f85284	Update common-errors.mdx (#17467 )	2 years ago
sarahalsmiller	b147323fb0	xds: Remove APIGateway ToIngress function (#17453 ) * xds generation for routes api gateway * Update gateway.go * move buildHttpRoute into xds package * Update agent/consul/discoverychain/gateway.go * remove unneeded function * convert http route code to only run for http protocol to future proof code path * Update agent/consul/discoverychain/gateway.go Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com> * fix tests, clean up http check logic * clean up todo * Fix casing in docstring * Fix import block, adjust docstrings * Rename func * Consolidate docstring onto single line * Remove ToIngress() conversion for APIGW, which generates its own xDS now * update name and comment * use constant value * use constant * rename readyUpstreams to readyListeners to better communicate what that function is doing --------- Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com> Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
John Murret	127eba6d61	docs: update the defaults for request limits (#17437 )	2 years ago
sarahalsmiller	6d35edc21c	xds: generate routes directly from API gateway snapshot (#17392 ) * xds generation for routes api gateway * Update gateway.go * move buildHttpRoute into xds package * Update agent/consul/discoverychain/gateway.go * remove unneeded function * convert http route code to only run for http protocol to future proof code path * Update agent/consul/discoverychain/gateway.go Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com> * fix tests, clean up http check logic * clean up todo * Fix casing in docstring * Fix import block, adjust docstrings * update name and comment * use constant value * use constant --------- Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com> Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
Dan Stough	7a8f33f1d5	chore(ci): skip cache for lint workflow (#17459 )	2 years ago
Derek Menteer	a90c9ce2b0	Fix ACL check on health endpoint (#17424 ) Fix ACL check on health endpoint Prior to this change, the service health API would not explicitly return an error whenever a token with invalid permissions was given, and it would instead return empty results. With this change, a "Permission denied" error is returned whenever data is queried. This is done to better support the agent cache, which performs a fetch backoff sleep whenever ACL errors are encountered. Affected endpoints are: `/v1/health/connect/` and `/v1/health/ingress/`.	2 years ago
Derek Menteer	e2f15cfe56	Fix namespaced peer service updates / deletes. (#17456 ) * Fix namespaced peer service updates / deletes. This change fixes a function so that namespaced services are correctly queried when handling updates / deletes. Prior to this change, some peered services would not correctly be un-exported. * Add changelog.	2 years ago
John Murret	b8eb98fcac	CI: do not upload test metrics to datadog on forks (#17448 ) * bypass uploading testmetrics to datadog on forks / when api is not available * add exclusions to upgrade tests	2 years ago
cskh	7166582b3e	CI: upload test results to datadog (#17438 ) Co-authored-by: John Murret <john.murret@hashicorp.com>	2 years ago
Paul Glass	07ff9d3d64	Use original_dst filter instead of use_original_dst field (#17433 )	2 years ago
wangxinyi7	0420b9769e	support ent debug mode (#17411 )	2 years ago
Luke Kysow	b74e41ecd1	Update service-intentions.mdx (#17443 )	2 years ago
Dan Upton	f9d14519e8	docs: first pass at a resource/controller developer guide (#17395 )	2 years ago
Ronald	ddb25cec0e	[NET-3092] Improve jwt-provider tests (#17430 ) * [NET-3092] more tests, prior to verify claims work	2 years ago
Dan Stough	d935c7b466	[OSS] gRPC Blocking Queries (#17426 ) * feat: initial grpc blocking queries * changelog and docs update	2 years ago
Dhia Ayachi	f526dfd0ac	add necessary plumbing to implement per server ip based rate limiting (#17436 )	2 years ago
R.B. Boyer	304d641fb1	extract some config entry helpers into package (#17434 )	2 years ago
Paul Glass	f0ba3f40bc	Integration test for permissive mTLS (#17205 ) * Integration test for permissive mTLS	2 years ago
Paul Glass	7f4fd2735a	Only synthesize anonymous token in primary DC (#17231 ) * Only synthesize anonymous token in primary DC * Add integration test for wan fed issue	2 years ago
Michael Zalimeni	b8d2640429	Disable remote proxy patching except AWS Lambda (#17415 ) To avoid unintended tampering with remote downstreams via service config, refactor BasicEnvoyExtender and RuntimeConfig to disallow typical Envoy extensions from being applied to non-local proxies. Continue to allow this behavior for AWS Lambda and the read-only Validate builtin extensions. Addresses CVE-2023-2816.	2 years ago
sarahalsmiller	e2a81aa8bd	xds: generate listeners directly from API gateway snapshot (#17398 ) * API Gateway XDS Primitives, endpoints and clusters (#17002) * XDS primitive generation for endpoints and clusters Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * server_test * deleted extra file * add missing parents to test --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * Routes for API Gateway (#17158) * XDS primitive generation for endpoints and clusters Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * server_test * deleted extra file * add missing parents to test * checkpoint * delete extra file * httproute flattening code * linting issue * so close on this, calling for tonight * unit test passing * add in header manip to virtual host * upstream rebuild commented out * Use consistent upstream name whether or not we're rebuilding * Start working through route naming logic * Fix typos in test descriptions * Simplify route naming logic * Simplify RebuildHTTPRouteUpstream * Merge additional compiled discovery chains instead of overwriting * Use correct chain for flattened route, clean up + add TODOs * Remove empty conditional branch * Restore previous variable declaration Limit the scope of this PR * Clean up, improve TODO * add logging, clean up todos * clean up function --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * checkpoint, skeleton, tests not passing * checkpoint * endpoints xds cluster configuration * resources test fix * fix reversion in resources_test * checkpoint * Update agent/proxycfg/api_gateway.go Co-authored-by: John Maguire <john.maguire@hashicorp.com> * unit tests passing * gofmt * add deterministic sorting to appease the unit test gods * remove panic * Find ready upstream matching listener instead of first in list * Clean up, improve TODO * Modify getReadyUpstreams to filter upstreams by listener (#17410) Each listener would previously have all upstreams from any route that bound to the listener. This is problematic when a route bound to one listener also binds to other listeners and so includes upstreams for multiple listeners. The list for a given listener would then wind up including upstreams for other listeners. * clean up todos, references to api gateway in listeners_ingress * merge in Nathan's fix * Update agent/consul/discoverychain/gateway.go * cleanup current todos, remove snapshot manipulation from generation code * Update agent/structs/config_entry_gateways.go Co-authored-by: Thomas Eckert <teckert@hashicorp.com> * Update agent/consul/discoverychain/gateway.go Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * Update agent/consul/discoverychain/gateway.go Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * Update agent/proxycfg/snapshot.go Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * clarified header comment for FlattenHTTPRoute, changed RebuildHTTPRouteUpstream to BuildHTTPRouteUpstream * simplify cert logic * Delete scratch * revert route related changes in listener PR * Update agent/consul/discoverychain/gateway.go * Update agent/proxycfg/snapshot.go * clean up uneeded extra lines in endpoints --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> Co-authored-by: John Maguire <john.maguire@hashicorp.com> Co-authored-by: Thomas Eckert <teckert@hashicorp.com>	2 years ago
R.B. Boyer	e00280e7df	prototest: fix early return condition in AssertElementsMatch (#17416 )	2 years ago
sarahalsmiller	d34bde0e4e	xds: generate clusters directly from API gateway snapshot (#17391 ) * endpoints xds cluster configuration * clusters xds native generation * resources test fix * fix reversion in resources_test * Update agent/proxycfg/api_gateway.go Co-authored-by: John Maguire <john.maguire@hashicorp.com> * gofmt * Modify getReadyUpstreams to filter upstreams by listener (#17410) Each listener would previously have all upstreams from any route that bound to the listener. This is problematic when a route bound to one listener also binds to other listeners and so includes upstreams for multiple listeners. The list for a given listener would then wind up including upstreams for other listeners. * Update agent/proxycfg/api_gateway.go Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * Restore import blocking * Undo removal of unrelated code --------- Co-authored-by: John Maguire <john.maguire@hashicorp.com> Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
Matt Keeler	93bad3ea1b	Allow resource updates to omit an owner refs UID (#17423 ) This change enables workflows where you are reapplying a resource that should have an owner ref to publish modifications to the resources data without performing a read to figure out the current owner resource incarnations UID. Basically we want workflows similar to `kubectl apply` or `consul config write` to be able to work seamlessly even for owned resources. In these cases the users intention is to have the resource owned by the “current” incarnation of the owner resource.	2 years ago
Ronald	113202d541	JWT Authentication with service intentions: xds package update (#17414 ) * JWT Authentication with service intentions: update xds package to translate config to envoy	2 years ago
sarahalsmiller	134aac7c26	xds: generate endpoints directly from API gateway snapshot (#17390 ) * endpoints xds cluster configuration * resources test fix * fix reversion in resources_test * Update agent/proxycfg/api_gateway.go Co-authored-by: John Maguire <john.maguire@hashicorp.com> * gofmt * Modify getReadyUpstreams to filter upstreams by listener (#17410) Each listener would previously have all upstreams from any route that bound to the listener. This is problematic when a route bound to one listener also binds to other listeners and so includes upstreams for multiple listeners. The list for a given listener would then wind up including upstreams for other listeners. * Update agent/proxycfg/api_gateway.go Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * Restore import blocking * Skip to next route if route has no upstreams * cleanup * change set from bool to empty struct --------- Co-authored-by: John Maguire <john.maguire@hashicorp.com> Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
Matt Keeler	1d6a0c8f21	Add the workload health controller (#17215 )	2 years ago
trujillo-adam	d20e3df63c	updates to links in services overview description paragraph (#17406 )	2 years ago
Nathan Coleman	a152e0ee7c	Add changelog entries for Consul 1.13.8 + 1.14.7 (#17399 )	2 years ago
Jeff Boruszak	bd5a3c137d	docs: Reference pages for service-router and service-resolver config entries (#17145 ) * service-resolve configuration entry reference * Updates * missing backtick * service router configuration entry reference * link fixes + tab fixes * link and tab fixes * link fixes * service resolver improvements * hierarchy fixes * spacing * links + formatting * proofing fixes * mmore fixes * Apply suggestions from code review suggestions from code review for service resolver Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * policy sections edits * service router code review * Tables to sections - service router HCL * YAML tables to sections * formatting fixes * converting tables to sections - service resolver * final tables to sections * Adjustments/alignments * nanosecond fix * Update website/content/docs/connect/config-entries/service-router.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * link to filter example config --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
trujillo-adam	94ea0a9731	Docs/igw docs day refactor (#17259 ) * reformatted IGW conf ref * set up nav structure for IGW docs * added main usage IGW usage doc * added usage for serving custom tls certs * updated internal links * Update website/content/docs/connect/config-entries/ingress-gateway.mdx * Apply suggestions from code review Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * changed filenames for IGW usage pages * Apply suggestions from code review Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>	2 years ago
cskh	1339c79f8d	consul-container test: no splitting and on single runner (#17394 )	2 years ago
Kyle Havlovitz	2904d0a431	Pull virtual IPs for filter chains from discovery chains (#17375 )	2 years ago
R.B. Boyer	21c6e0e8e6	fix two typos (#17389 )	2 years ago
R.B. Boyer	2f5256ec7a	test: slight refactoring ahead of peering testing improvements (#17387 )	2 years ago
John Landa	8f6b9fe177	Add ACLs Enabled field to consul agent startup status message (#17086 ) * Add ACLs Enabled field to consul agent startup status message * Add changelog * Update startup messages to include default ACL policy configuration * Correct import groupings	2 years ago
Connor	0789661ce5	Rename hcp-metrics-collector to consul-telemetry-collector (#17327 ) * Rename hcp-metrics-collector to consul-telemetry-collector * Fix docs * Fix doc comment --------- Co-authored-by: Ashvitha Sridharan <ashvitha.sridharan@hashicorp.com>	2 years ago
R.B. Boyer	06481bf03a	test: fix oss/ent drift in gateway container tests (#17365 )	2 years ago
Dan Bond	8dee353492	agent: don't write server metadata in dev mode (#17383 ) Signed-off-by: Dan Bond <danbond@protonmail.com>	2 years ago
cskh	59db5e1a2a	integ-test CI: retry if fail to install packages (#17359 )	2 years ago
wangxinyi7	70ed184c2b	counterpart of the ent in oss (#17367 )	2 years ago
Dan Stough	be7d2a4d84	fix(connect envoy): set initial_fetch_timeout to wait for initial xDS… (#17317 ) * fix(connect envoy): set initial_fetch_timeout to wait for initial xDS indefinitely --------- Co-authored-by: Kiril Angov <kiril.angov@gmail.com>	2 years ago

1 2 3 4 5 ...

20123 Commits (8c74a1d33ee121e45491d9dfdc7599b8ca54e2a3) All Branches Search

20123 Commits (8c74a1d33ee121e45491d9dfdc7599b8ca54e2a3)

All Branches