2272 Commits (8ce8dbf3611e5178622e7f7fb5722fa0e5962e7e)

Author	SHA1	Message	Date
Florian Apolloner	077b0a48a3	Allow Operator Generated bootstrap token (#14437) ... Add support to provide an initial token via the bootstrap HTTP API, similar to hashicorp/nomad#12520	2 years ago
Hans Hasselberg	275a0b8e7f	fix cli string for id flag (#15695)	2 years ago
Dan Stough	b3bd3a6586	[OSS] feat: access logs for listeners and listener filters (#15864) ... * feat: access logs for listeners and listener filters * changelog * fix integration test	2 years ago
Michael Wilkerson	1b28b89439	Enhancement: Consul Compatibility Checking (#15818) ... * add functions for returning the max and min Envoy major versions - added an UnsupportedEnvoyVersions list - removed an unused error from TestDetermineSupportedProxyFeaturesFromString - modified minSupportedVersion to use the function for getting the Min Envoy major version. Using just the major version without the patch is equivalent to using `.0` * added a function for executing the envoy --version command - added a new exec.go file to not be locked to unix system * added envoy version check when using consul connect envoy * added changelog entry * added docs change	2 years ago
Chris S. Kim	f7b7f5d4b6	Error out `consul connect envoy` if agent explicitly disabled grpc (#15794) ... Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Paul Glass	619032cfcd	Deprecate -join and -join-wan (#15598)	2 years ago
Semir Patel	bafa5c7156	Pass remote addr of incoming HTTP requests through to RPC(..) calls (#15700)	2 years ago
James Oulman	7e78fb7818	Add support for configuring Envoys route idle_timeout (#14340) ... * Add idleTimeout Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
Derek Menteer	6fa8fa4fca	Fix issue with connect Envoy choosing incorrect TLS settings. (#15466) ... This commit fixes a situation where the API TLS configuration incorrectly influences the GRPC port TLS configuration for XDS.	2 years ago
Dhia Ayachi	225ae55e83	Leadership transfer cmd (#14132) ... * add leadership transfer command * add RPC call test (flaky) * add missing import * add changelog * add command registration * Apply suggestions from code review Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> * add the possibility of providing an id to raft leadership transfer. Add few tests. * delete old file from cherry pick * rename changelog filename to PR # * rename changelog and fix import * fix failing test * check for OperatorWrite Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> * rename from leader-transfer to transfer-leader * remove version check and add test for operator read * move struct to operator.go * first pass * add code for leader transfer in the grpc backend and tests * wire the http endpoint to the new grpc endpoint * remove the RPC endpoint * remove non needed struct * fix naming * add mog glue to API * fix comment * remove dead code * fix linter error * change package name for proto file * remove error wrapping * fix failing test * add command registration * add grpc service mock tests * fix receiver to be pointer * use defined values Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> * reuse MockAclAuthorizer * add documentation * remove usage of external.TokenFromContext * fix failing tests * fix proto generation * Apply suggestions from code review Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Apply suggestions from code review * add more context in doc for the reason * Apply suggestions from docs code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * regenerate proto * fix linter errors Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com> Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	2 years ago
Kyle Schochenmaier	bf0f61a878	removes ioutil usage everywhere which was deprecated in go1.16 (#15297) ... * update go version to 1.18 for api and sdk, go mod tidy * removes ioutil usage everywhere which was deprecated in go1.16 in favour of io and os packages. Also introduces a lint rule which forbids use of ioutil going forward. Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	2 years ago
Derek Menteer	b64972d486	Bring back parameter ServerExternalAddresses in GenerateToken endpoint (#15267) ... Re-add ServerExternalAddresses parameter in GenerateToken endpoint This reverts commit 5e156772f6 and adds extra functionality to support newer peering behaviors.	2 years ago
Chris S. Kim	0e176dd6aa	Allow consul debug on non-ACL consul servers (#15155)	2 years ago
Luke Kysow	fbd47e1161	config entry: hardcode proxy-defaults name as global (#14833) ... * config entry: hardcode proxy-defaults name as global proxy-defaults can only have the name global. Because of this, we support not even setting the name in the config file: ``` kind = "proxy-defaults" ``` Previously, writing this would result in the output: ``` Config entry written: proxy-defaults/ ``` Now it will output: ``` Config entry written: proxy-defaults/global ``` This change follows what was done for the new Mesh config entry.	2 years ago
R.B. Boyer	da70daba43	test: ensure that all dependencies in a test agent use the test logger (#14996)	2 years ago
Chris S. Kim	bde57c0dd0	Regenerate files according to 1.19.2 formatter	2 years ago
Iryna Shustava	2a25669b13	cli/sdk: Allow redirection to a different consul dns port (#15050)	2 years ago
Curt Bushko	161273a931	Update command/connect/envoy/bootstrap_tpl.go ... Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Curt Bushko	cd185c4c2c	update prometheus template args	2 years ago
Nitya Dhanushkodi	5e156772f6	Remove ability to specify external addresses in GenerateToken endpoint (#14930) ... * Reverts "update generate token endpoint to take external addresses (#13844)" This reverts commit f47319b7c6.	2 years ago
Iryna Shustava	5cd0ccfc75	Support auth method with snapshot agent [ENT] (#15020) ... Port of hashicorp/consul-enterprise#3303	2 years ago
Iryna Shustava	4bc4ef135c	cli: Add -node-name flag to redirect-traffic command (#14933)	2 years ago
cskh	eb26a7dee9	fix(cli): missing error message (#14959)	2 years ago
Chris S. Kim	b0a4c5c563	Include stream-related information in peering endpoints	2 years ago
freddygv	fac3ddc857	Use internal server certificate for peering TLS ... A previous commit introduced an internally-managed server certificate to use for peering-related purposes. Now the peering token has been updated to match that behavior: - The server name matches the structure of the server cert - The CA PEMs correspond to the Connect CA Note that if Conect is disabled, and by extension the Connect CA, we fall back to the previous behavior of returning the manually configured certs and local server SNI. Several tests were updated to use the gRPC TLS port since they enable Connect by default. This means that the peering token will embed the Connect CA, and the dialer will expect a TLS listener.	2 years ago
Eric Haberkorn	1b565444be	Rename `PeerName` to `Peer` on prepared queries and exported services (#14854)	2 years ago
Eric Haberkorn	80e51ff907	Add exported services event to cluster peering replication. (#14797)	2 years ago
Nick Ethier	1c1b0994b8	add HCP integration component (#14723) ... * add HCP integration * lint: use non-deprecated logging interface	2 years ago
DanStough	2a2debee64	feat(peering): validate server name conflicts on establish	2 years ago
Chris S. Kim	7370f0a953	Fix test ordering (#14543)	2 years ago
Derek Menteer	bf769daae4	Merge branch 'main' of github.com:hashicorp/consul into derekm/split-grpc-ports	2 years ago
Derek Menteer	f64771c707	Address PR comments.	2 years ago
DanStough	e617e7df3e	feat(cli): add initial peering cli commands	2 years ago
Derek Menteer	1255a8a20d	Add separate grpc_tls port. ... To ease the transition for users, the original gRPC port can still operate in a deprecated mode as either plain-text or TLS mode. This behavior should be removed in a future release whenever we no longer support this. The resulting behavior from this commit is: `ports.grpc > 0 && ports.grpc_tls > 0` spawns both plain-text and tls ports. `ports.grpc > 0 && grpc.tls == undefined` spawns a single plain-text port. `ports.grpc > 0 && grpc.tls != undefined` spawns a single tls port (backwards compat mode).	2 years ago
Dao Thanh Tung	fead3c537b	Fix Consul KV CLI 'GET' flags 'keys' and 'recurse' to be set together (#13493) ... allow flags -recurse and -keys to be run at the same time in consul kv get CLI	2 years ago
Jared Kirschner	1200e83c3b	Merge pull request #14034 from hashicorp/make-proxy-sidecar-for-case-insensitive ... Allow uppercase in proxy launch -sidecar-for arg	2 years ago
Daniel Upton	6e0de48e60	cli: update agent log preamble to reflect per-listener TLS config	2 years ago
Jared Kirschner	22511ec491	Allow uppercase in proxy launch -sidecar-for arg ... Previously, when launching a sidecar proxy with one of the following commands: - consul connect envoy -sidecar-for=... - consul connect proxy -sidecar-for=... ... the -sidecar-for argument could only contain lowercase letters, even if the service was registered with some uppercase letters. Now, the -sidecar-for argument is treated as case-insensitive.	2 years ago
cskh	155c4bc2af	fix(cli): error message in service deregister subcommand (#14028)	2 years ago
cskh	6640997fc1	fix (cli): import empty directory to kv (#13939) ... * fix (cli): import empty directory to kv - when import an empty directory like foo/, the import command will remove the trailing /, making it a non-directory key. - This change fixes the bug by adding back the / if the imported key is an directory	2 years ago
Chris S. Kim	8ed49ea4d0	Update envoy metrics label extraction for peered clusters and listeners (#13818) ... Now that peered upstreams can generate envoy resources (#13758), we need a way to disambiguate local from peered resources in our metrics. The key difference is that datacenter and partition will be replaced with peer, since in the context of peered resources partition is ambiguous (could refer to the partition in a remote cluster or one that exists locally). The partition and datacenter of the proxy will always be that of the source service. Regexes were updated to make emitting datacenter and partition labels mutually exclusive with peer labels. Listener filter names were updated to better match the existing regex. Cluster names assigned to peered upstreams were updated to be synthesized from local peer name (it previously used the externally provided primary SNI, which contained the peer name from the other side of the peering). Integration tests were updated to assert for the new peer labels.	2 years ago
DanStough	2da8949d78	feat: convert destination address to slice	2 years ago
Paul Glass	77afe0e76e	Extract AWS auth implementation out of Consul (#13760)	2 years ago
Jared Kirschner	067272b53f	Merge pull request #13787 from hashicorp/fix-acl-read-token-self-expanded-panic ... Fix panic on acl token read with -self and -expanded	2 years ago
Jared Kirschner	927033e672	Fix panic on acl token read with -self and -expanded	2 years ago
cskh	cf6b6dddaf	feat(cli): enable to delete config entry from an input file (#13677) ... * feat(cli): enable to delete config entry from an input file - A new flag to config delete to delete a config entry in a valid config file, e.g., config delete -filename intention-allow.hcl - Updated flag validation; -filename and -kind can't be set at the same time - Move decode config entry method from config_write.go to helpers.go for reusing ParseConfigEntry() - add changelog Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
Kyle Havlovitz	407e858389	Fix syntax for bootstrap sds secret config	2 years ago
R.B. Boyer	31b95c747b	xds: modify rbac rules to use the XFCC header for peered L7 enforcement (#13629) ... When the protocol is http-like, and an intention has a peered source then the normal RBAC mTLS SAN field check is replaces with a joint combo of: mTLS SAN field must be the service's local mesh gateway leaf cert AND the first XFCC header (from the MGW) must have a URI field that matches the original intention source Also: - Update the regex program limit to be much higher than the teeny defaults, since the RBAC regex constructions are more complicated now. - Fix a few stray panics in xds generation.	2 years ago
Kyle Havlovitz	55109eb9f6	command: Add TLS support for envoy prometheus endpoint	2 years ago
Riddhi Shah	411edc876b	[OSS] Support merge-central-config option in node services list API (#13450) ... Adds the merge-central-config query param option to the /catalog/node-services/:node-name API, to get a service definition in the response that is merged with central defaults (proxy-defaults/service-defaults). Updated the consul connect envoy command to use this option when retrieving the proxy service details so as to render the bootstrap configuration correctly.	2 years ago