3676 Commits (8e9773e20b0ee92cc2a5d34f9b5b52546a4c7b58)

Author	SHA1	Message	Date
Chris S. Kim	f972048ebc	connect: Allow upstream listener escape hatch for prepared queries (#11109)	3 years ago
R.B. Boyer	706fc8bcd0	grpc: strip local ACL tokens from RPCs during forwarding if crossing datacenters (#11099) ... Fixes #11086	3 years ago
Daniel Nephin	54256fb751	config: Move two more fields to DeprecatedConfig ... And add a test for deprecated config fields.	3 years ago
Daniel Nephin	8ed14296ea	config: Introduce DeprecatedConfig ... This struct allows us to move all the deprecated config options off of the main config struct, and keeps all the deprecation logic in a single place, instead of spread across 3+ places.	3 years ago
Connor	1e3ba26223	Merge pull request #11090 from hashicorp/clly/kv-usage-metrics ... Add KVUsage to consul state usage metrics	3 years ago
Connor Kelly	ba706501e1	Strip out go 1.17 bits	3 years ago
Matt Keeler	a6a359cc80	Add a mock Agent delegate to ease/improve some types of testing	3 years ago
hc-github-team-consul-core	47b99d0b78	auto-updated agent/uiserver/bindata_assetfs.go from commit 9c0233cf5	3 years ago
hc-github-team-consul-core	7efb015ca9	auto-updated agent/uiserver/bindata_assetfs.go from commit cfbd1bb84	3 years ago
Daniel Nephin	72f2199ea1	acl: remove remaining tests that use ACL.Apply ... In preparation for removing ACL.Apply. Tests for ACL.Apply, ACL.GetPolicy, and ACL upgrades were removed because all 3 of those will be removed shortly. The forth test appears to be for the ACLResolver cache, so the test was moved to the correct test file, and the name was updated to make it obvious what is being tested.	3 years ago
Daniel Nephin	eb991c18c2	fsm: restore the legacy commands ... and emit a helpful error message.	3 years ago
Daniel Nephin	fa4b33ab8f	Convert tests to the new ACL system ... In preparation for removing ACL.Apply	3 years ago
Daniel Nephin	5779af1f62	config: use the new ACL system in tests ... In preparation for removing ACL.Apply	3 years ago
Daniel Nephin	d64409f66f	catalog: use the new ACL system in tests ... In preparation for removing ACL.Apply	3 years ago
Daniel Nephin	3b9578d7eb	Update 4 non-acl tests that used the legacy ACL.Apply ... These tests don't really care about the endpoint, they just need some way to create an ACL token.	3 years ago
Daniel Nephin	746f67b3a1	acl: remove two commented out tests for legacy ACL replication ... They were commented out in 2018.	3 years ago
Daniel Nephin	abd9cd0e15	acl: replace legacy Get and List RPCs with an error impl ... These endpoints are being removed as part of the legacy ACL system.	3 years ago
Daniel Nephin	e7c63004a8	acl: remove a couple legacy ACL operation constants ... structs.ACLForceSet was deprecated 4 years ago, it should be safe to remove now. ACLBootstrapNow was removed in a recent commit. While it is technically possible that a cluster with mixed version could still attempt a legacy boostrap, we documented that the legacy system was deprecated in 1.4, so no clusters that are being upgraded should be attempting a legacy boostrap.	3 years ago
Daniel Nephin	868bfc7a0a	acl: Remove unused ACLPolicyIDType	3 years ago
Daniel Nephin	aee8a9511d	Merge pull request #10985 from hashicorp/dnephin/acl-legacy-remove-replication ... acl: remove legacy ACL replication	3 years ago
Connor	1ddee0680c	Apply suggestions from code review ... Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	3 years ago
R.B. Boyer	b2d17ac448	xds: fix representation of incremental xDS subscriptions (#10987) ... Fixes #10563 The `resourceVersion` map was doing two jobs prior to this PR. The first job was to track what version of every resource we know envoy currently has. The second was to track subscriptions to those resources (by way of the empty string for a version). This mostly works out fine, but occasionally leads to consul removing a resource and accidentally (effectively) unsubscribing at the same time. The fix separates these two jobs. When all of the resources for a subscription are removed we continue to track the subscription until envoy explicitly unsubscribes	3 years ago
Connor Kelly	ae3457b96a	Fix test	3 years ago
Connor Kelly	052f224ee5	Add KVUsage to consul state usage metrics ... This change will add the number of entries in the consul KV store to the already existing usage metrics.	3 years ago
R.B. Boyer	5fe613dd05	xds: ensure the active streams counters are 64 bit aligned on 32 bit systems (#11085)	3 years ago
Krastin Krastev	f7b0938633	Update autopilot.go ... Fixing a minuscule typo in logging	3 years ago
Freddy	8591620b5d	Merge pull request #11071 from hashicorp/partitions/ixn-decisions	3 years ago
freddygv	49248a0802	Fixup proxycfg tproxy case	3 years ago
freddygv	fc8fc060a7	Remove ent checks from oss test	3 years ago
R.B. Boyer	faa6fd0919	acl: ensure the global management policy grants all necessary partition privileges (#11072)	3 years ago
freddygv	bf7a1358d6	Ensure partition is defaulted in authz	3 years ago
freddygv	47109e0c0c	Default the partition in ixn check	3 years ago
freddygv	82d2caa288	Fixup test	3 years ago
freddygv	95a6db9cfa	Account for partitions in ixn match/decision	3 years ago
Jeff Widman	2dc62aa0c4	Bump `go-discover` to fix broken dep tree (#10898)	3 years ago
hc-github-team-consul-core	42b7fd3e60	auto-updated agent/uiserver/bindata_assetfs.go from commit 1d9d3349c	3 years ago
R.B. Boyer	ca73abdea1	acl: fix intention:*:write checks (#11061) ... This is a partial revert of #10793	3 years ago
Freddy	cd08a36ce0	Merge pull request #11051 from hashicorp/partitions/fixes	3 years ago
Freddy	fcef19f94b	acl: small resolver changes to account for partitions (#11052) ... Also refactoring the enterprise side of a test to make it easier to reason about.	3 years ago
freddygv	3f3a61c6e1	Fixup manager tests	3 years ago
freddygv	99c6e4fe41	Default partition in match endpoint	3 years ago
freddygv	77681b9f6c	Pass partition to intention match query	3 years ago
freddygv	9cd30e8650	Ensure partition is used for SAN validation	3 years ago
Mark Anderson	9f12fbd3cc	ACL Binding Rules table partitioning (#11044) ... * ACL Binding Rules table partitioning Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
hc-github-team-consul-core	02051c141e	auto-updated agent/uiserver/bindata_assetfs.go from commit fc14a412f	3 years ago
hc-github-team-consul-core	0eb4a98fab	auto-updated agent/uiserver/bindata_assetfs.go from commit b16a6fa03	3 years ago
Dhia Ayachi	af21578039	use const instead of literals for `tableIndex` (#11039)	3 years ago
Mark Anderson	6be54052f7	Refactor `indexAuthMethod` in `tableACLBindingRules` (#11029) ... * Port consul-enterprise #1123 to OSS Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Fixup missing query field Signed-off-by: Mark Anderson <manderson@hashicorp.com> * change to re-trigger ci system Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Freddy	ce04ce13dd	Merge pull request #11024 from hashicorp/partitions/rbac	3 years ago
Freddy	e18f3c1f6d	Update error texts (#11022) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
freddygv	d90e30f009	Update spiffe ID patterns used for RBAC	3 years ago
freddygv	5e54f253d7	Expand testing of simplifyNotSourceSlice for partitions	3 years ago
freddygv	19da23be28	Expand testing of removeSameSourceIntentions for partitions	3 years ago
freddygv	beab0cd962	Account for partition when matching src intentions	3 years ago
Daniel Nephin	1f9479603c	Add failures_before_warning to checks (#10969) ... Signed-off-by: Jakub Sokołowski <jakub@status.im> * agent: add failures_before_warning setting The new setting allows users to specify the number of check failures that have to happen before a service status us updated to be `warning`. This allows for more visibility for detected issues without creating alerts and pinging administrators. Unlike the previous behavior, which caused the service status to not update until it reached the configured `failures_before_critical` setting, now Consul updates the Web UI view with the `warning` state and the output of the service check when `failures_before_warning` is breached. The default value of `FailuresBeforeWarning` is the same as the value of `FailuresBeforeCritical`, which allows for retaining the previous default behavior of not triggering a warning. When `FailuresBeforeWarning` is set to a value higher than that of `FailuresBeforeCritical it has no effect as `FailuresBeforeCritical` takes precedence. Resolves: https://github.com/hashicorp/consul/issues/10680 Signed-off-by: Jakub Sokołowski <jakub@status.im> Co-authored-by: Jakub Sokołowski <jakub@status.im>	3 years ago
Dhia Ayachi	b4d5860197	convert expiration indexed in ACLToken table to use `indexerSingle` (#11018) ... * move intFromBool to be available for oss * add expiry indexes * remove dead code: `TokenExpirationIndex` * fix remove indexer `TokenExpirationIndex` * fix rebase issue	3 years ago
Dhia Ayachi	11f44dfcf8	add locality indexer partitioning (#11016) ... * convert `Roles` index to use `indexerSingle` * split authmethod write indexer to oss and ent * add index locality * add locality unit tests * move intFromBool to be available for oss * use Bool func * refactor `aclTokenList` to merge func	3 years ago
Dhia Ayachi	ba4ee6e67c	convert `indexAuthMethod` index to use `indexerSingle` (#11014) ... * convert `Roles` index to use `indexerSingle` * fix oss build * split authmethod write indexer to oss and ent * add auth method unit tests	3 years ago
Paul Banks	b38e84df63	Include namespace and partition in error messages when validating ingress header manip	3 years ago
Paul Banks	1079089f20	Refactor HTTPHeaderModifiers.MergeDefaults based on feedback	3 years ago
Paul Banks	9e4e204e96	Fix enterprise test failures caused by differences in normalizing EnterpriseMeta	3 years ago
Paul Banks	3004eadd08	Fix enterprise discovery chain tests; Fix multi-level split merging	3 years ago
Paul Banks	b5ae00d753	Remove unnecessary check	3 years ago
Paul Banks	f1c0876b4c	Fix discovery chain test fixtures	3 years ago
Paul Banks	1b9632531a	Integration tests for all new header manip features	3 years ago
Paul Banks	e22cc9c53a	Header manip for split legs plumbing	3 years ago
Paul Banks	83fc8723a3	Header manip for service-router plumbed through	3 years ago
Paul Banks	f439dfc04f	Ingress gateway header manip plumbing	3 years ago
Paul Banks	d776a2d236	Add HTTP header manip for router and splitter entries	3 years ago
Paul Banks	46e4041283	Header manip and validation added for ingress-gateway entries	3 years ago
Dhia Ayachi	6cac30aa22	convert `Roles` index to use `indexerMulti` (#11013) ... * convert `Roles` index to use `indexerMulti` * add role test in oss * fix oss to use the right index func * preallocate slice	3 years ago
Dhia Ayachi	f3f0654038	convert indexPolicies in ACLTokens table to the new index (#11011)	3 years ago
Dhia Ayachi	584faec6e3	convert indexSecret to the new index (#11007)	3 years ago
Dhia Ayachi	6e6cf1c043	convert indexAccessor to the new index (#11002)	3 years ago
Hans Hasselberg	13238dbab6	tls: consider presented intermediates during server connection tls handshake. (#10964) ... * use intermediates when verifying * extract connection state * remove useless import * add changelog entry * golint * better error * wording * collect errors * use SAN.DNSName instead of CommonName * Add test for unknown intermediate * improve changelog entry	3 years ago
Chris S. Kim	9bbfa048a2	Sync enterprise changes to oss (#10994) ... This commit updates OSS with files for enterprise-specific admin partitions feature work	3 years ago
Kyle Havlovitz	a14950025a	Merge pull request #10984 from hashicorp/mesh-resource ... acl: adding a new mesh resource	3 years ago
Dhia Ayachi	bc0e4f2f46	partition dicovery chains (#10983) ... * partition dicovery chains * fix default partition for OSS	3 years ago
Daniel Nephin	f063402b29	acl: remove ACL.IsSame ... The only caller of this method was removed in a recent commit along with replication.	3 years ago
Daniel Nephin	d63cef1219	acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ee372a854a	acl: adding a new mesh resource	3 years ago
Dhia Ayachi	ced8329d80	try to infer command partition from node partition (#10981)	3 years ago
Dhia Ayachi	09197c989c	add partition to SNI when partition is non default (#10917)	3 years ago
Freddy	8d83d27674	connect: update envoy supported versions to latest patch release ... (#10961) Relevant advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h	3 years ago
Evan Culver	79c7e73618	rpc: authorize raft requests (#10925)	3 years ago
hc-github-team-consul-core	cd3333ad6a	auto-updated agent/uiserver/bindata_assetfs.go from commit eeeb91bea	3 years ago
Chris S. Kim	1a9b2f09dd	ent->oss test fix (#10926)	3 years ago
hc-github-team-consul-core	2d66c4ea13	auto-updated agent/uiserver/bindata_assetfs.go from commit a907e1d87	3 years ago
hc-github-team-consul-core	a163051dbb	auto-updated agent/uiserver/bindata_assetfs.go from commit a0b0ed2bc	3 years ago
Chris S. Kim	45dcc8b553	api: expose upstream routing configurations in topology view (#10811) ... Some users are defining routing configurations that do not have associated services. This commit surfaces these configs in the topology visualization. Also fixes a minor internal bug with non-transparent proxy upstream/downstream references.	3 years ago
R.B. Boyer	a6d22efb49	acl: some acl authz refactors for nodes (#10909)	3 years ago
hc-github-team-consul-core	11b1dc1f97	auto-updated agent/uiserver/bindata_assetfs.go from commit a777b0a9b	3 years ago
hc-github-team-consul-core	5e31421602	auto-updated agent/uiserver/bindata_assetfs.go from commit 8192dde48	3 years ago
R.B. Boyer	5b6d96d27d	grpc: ensure that streaming gRPC requests work over mesh gateway based wan federation (#10838) ... Fixes #10796	3 years ago
hc-github-team-consul-core	4993d877d9	auto-updated agent/uiserver/bindata_assetfs.go from commit 05a28c311	3 years ago
freddygv	01936ddb70	Avoid passing zero value into variadic	3 years ago
freddygv	f52bd80f6d	Update comment for test function	3 years ago
freddygv	af52d21884	Update prepared query cluster SAN validation ... Previously SAN validation for prepared queries was broken because we validated against the name, namespace, and datacenter for prepared queries. However, prepared queries can target: - Services with a name that isn't their own - Services in multiple datacenters This means that the SpiffeID to validate needs to be based on the prepared query endpoints, and not the prepared query's upstream definition. This commit updates prepared query clusters to account for that.	3 years ago
freddygv	85878685b7	Fixup proxy config test fixtures ... - The TestNodeService helper created services with the fixed name "web", and now that name is overridable. - The discovery chain snapshot didn't have prepared query endpoints so the endpoints tests were missing data for prepared queries	3 years ago
R.B. Boyer	fb27c1b24f	agent: add partition labels to catalog API metrics where appropriate (#10890)	3 years ago