1583 Commits (919316f188c1e9b77418e7ee8080cdad5838679e)

Author	SHA1	Message	Date
freddygv	1a14b94441	Update default gossip encryption key size to 32 bytes	5 years ago
hashicorp-ci	847b90288a	Merge Consul OSS branch 'master' at commit a1725e6b52	5 years ago
Matt Keeler	a1725e6b52	Fix flaky tests (#6229)	5 years ago
Matt Keeler	fcc18c1675	Fix prepared query upstream endpoint generation (#6236) ... Use the correct SNI value for prepared query upstreams	5 years ago
hashicorp-ci	1527616c8c	update bindata_assetfs.go	5 years ago
Matt Keeler	35e67b1d1a	Fix CA Replication when ACLs are enabled (#6201) ... Secondary CA initialization steps are: • Wait until the primary will be capable of signing intermediate certs. We use serf metadata to check the versions of servers in the primary which avoids needing a token like the previous implementation that used RPCs. We require at least one alive server in the primary and the all alive servers meet the version requirement. • Initialize the secondary CA by getting the primary to sign an intermediate When a primary dc is configured, if no existing CA is initialized and for whatever reason we cannot initialize a secondary CA the secondary DC will remain without a CA. As soon as it can it will initialize the secondary CA by pulling the primaries roots and getting the primary to sign an intermediate. This also fixes a segfault that can happen during leadership revocation. There was a spot in the secondaryCARootsWatch that was getting the CA Provider and executing methods on it without nil checking. Under normal circumstances it wont be nil but during leadership revocation it gets nil'ed out. Therefore there is a period of time between closing the stop chan and when the go routine is actually stopped where it could read a nil provider and cause a segfault.	5 years ago
R.B. Boyer	c6c4a2251a	Merge Consul OSS branch master at commit b3541c4f34	5 years ago
hashicorp-ci	0c9c5bfa98	update bindata_assetfs.go	5 years ago
Jack Pearkes	4e0a16ab2d	config: correct limit to limits in config example (#6219) ... This isn't yet documented on the website, but wanted to update this to add the missing s.	5 years ago
Matt Keeler	8b54307be2	Allow forwarding of some status RPCs (#6198) ... * Allow forwarding of some status RPCs * Update docs * add comments about not using the regular forward	5 years ago
Jeff Mitchell	1ea7a34756	Make the chunking test multidimensional (#6212) ... This ensures that it's not just a single operation we restores successfully, but many. It's the same foundation, just with multiple going on at once.	5 years ago
Freddy	89158c7a76	auto-encrypt: Fix port resolution and fallback to default port (#6205) ... Auto-encrypt meant to fallback to the default port when it wasn't provided, but it hadn't been because of an issue with the error handling. We were checking against an incomplete error value: "missing port in address" vs "address $HOST: missing port in address" Additionally, all RPCs to AutoEncrypt.Sign were using a.config.ServerPort, so those were updated to use ports resolved by resolveAddrs, if they are available.	5 years ago
Jeff Mitchell	94c73d0c92	Chunking support (#6172) ... * Initial chunk support This uses the go-raft-middleware library to allow for chunked commits to the KV	5 years ago
Matt Keeler	3053342198	Envoy Mesh Gateway integration tests (#6187) ... * Allow setting the mesh gateway mode for an upstream in config files * Add envoy integration test for mesh gateways This necessitated many supporting changes in most of the other test cases. Add remote mode mesh gateways integration test	5 years ago
Freddy	199f6cc41d	Make new config when retrying testServer creation (#6204)	5 years ago
R.B. Boyer	ad9e7b6ae9	connect: allow L7 routers to match on http methods (#6164) ... Fixes #6158	5 years ago
R.B. Boyer	85cf2706e6	connect: change router syntax for matching query parameters to resemble the syntax for matching paths and headers for consistency. (#6163) ... This is a breaking change, but only in the context of the beta series.	5 years ago
R.B. Boyer	1dbd92e091	connect: validate and test more of the L7 config entries (#6156)	5 years ago
R.B. Boyer	e039dfd7f8	connect: rework how the service resolver subset OnlyPassing flag works (#6173) ... The main change is that we no longer filter service instances by health, preferring instead to render all results down into EDS endpoints in envoy and merely label the endpoints as HEALTHY or UNHEALTHY. When OnlyPassing is set to true we will force consul checks in a 'warning' state to render as UNHEALTHY in envoy. Fixes #6171	5 years ago
Alvin Huang	ef6b80bab2	resolve circleci config conflicts	5 years ago
Freddy	d86efb83e5	Restore NotifyListen to avoid panic in newServer retry (#6200)	5 years ago
Pierre Souchay	b4590fb8e8	Display nicely Networks (CIDR) in runtime configuration (#6029) ... * Display nicely Networks (CIDR) in runtime configuration CIDR mask is displayed in binary in configuration. This add support for nicely displaying CIDR in runtime configuration. Currently, if a configuration contains the following lines: "http_config": { "allow_write_http_from": [ "127.0.0.0/8", "::1/128" ] } A call to `/v1/agent/self?pretty` would display "AllowWriteHTTPFrom": [ { "IP": "127.0.0.0", "Mask": "/wAAAA==" }, { "IP": "::1", "Mask": "/////////////////////w==" } ] This PR fixes it and it will now display: "AllowWriteHTTPFrom": [ "127.0.0.0/8", "::1/128" ] * Added test for cidr nice rendering in `TestSanitize()`.	5 years ago
Matt Keeler	d7fe8befa9	Update go-bexpr (#6190) ... * Update go-bexpr to v0.1.1 This brings in: • `in`/`not in` operators to do substring matching • `matches` / `not matches` operators to perform regex string matching. * Add the capability to auto-generate the filtering selector ops tables for our docs	5 years ago
Paul Banks	f38da47c55	Allow raft TrailingLogs to be configured. (#6186) ... This fixes pathological cases where the write throughput and snapshot size are both so large that more than 10k log entries are written in the time it takes to restore the snapshot from disk. In this case followers that restart can never catch up with leader replication again and enter a loop of constantly downloading a full snapshot and restoring it only to find that snapshot is already out of date and the leader has truncated its logs so a new snapshot is sent etc. In general if you need to adjust this, you are probably abusing Consul for purposes outside its design envelope and should reconsider your usage to reduce data size and/or write volume.	5 years ago
Christian Muehlhaeuser	7753b97cc7	Simplified code in various places (#6176) ... All these changes should have no side-effects or change behavior: - Use bytes.Buffer's String() instead of a conversion - Use time.Since and time.Until where fitting - Drop unnecessary returns and assignment	5 years ago
hashicorp-ci	a4431da1cc	Merge Consul OSS branch 'master' at commit ef257b084d	5 years ago
javicrespo	b006060d4c	log rotation: limit count of rotated log files (#5831)	5 years ago
Christian Muehlhaeuser	61ff1d20bf	Avoid unnecessary conversions (#6178) ... Those values already have the right type.	5 years ago
Christian Muehlhaeuser	1366bebf7f	Fixed typos in comments (#6175) ... Just a few nitpicky typo fixes.	5 years ago
Christian Muehlhaeuser	16193665ca	Fixed a few tautological condition mistakes (#6177) ... None of these changes should have any side-effects. They're merely fixing tautological mistakes.	5 years ago
Christian Muehlhaeuser	ed4e64f6b2	Fixed nil check for token (#6179) ... I can only assume we want to check for the retrieved `updatedToken` to not be nil, before accessing it below. `token` can't possibly be nil at this point, as we accessed `token.AccessorID` just before.	5 years ago
Alvin Huang	6f1953d96d	Merge branch 'master' into release/1-6	5 years ago
R.B. Boyer	d7a5158805	xds: allow http match criteria to be applied to routes on services using grpc protocols (#6149)	5 years ago
R.B. Boyer	b16d7f00bc	agent: avoid reverting any check updates that occur while a service is being added or the config is reloaded (#6144)	5 years ago
Freddy	5526cfac8b	Reduce number of servers in TestServer_Expect_NonVoters (#6155)	5 years ago
Freddy	59dbd070d7	More flaky test fixes (#6151) ... * Add retry to TestAPI_ClientTxn * Add retry to TestLeader_RegisterMember * Account for empty watch result in ConnectRootsWatch	5 years ago
hashicorp-ci	fa20c7db97	Merge Consul OSS branch 'master' at commit 95dbb7f2f1	5 years ago
Sarah Adams	ea2bd5b728	http/tcp checks: fix long timeout behavior to default to user-configured value (#6094) ... Fixes #5834	5 years ago
Freddy	d219e31db8	Update retries that weren't using retry.R (#6146)	5 years ago
hashicorp-ci	4bb858161e	update bindata_assetfs.go	5 years ago
R.B. Boyer	e8132b61c0	add test for discovery chain agent cache-type (#6130)	5 years ago
Jack Pearkes	338aed32af	Merge branch 'master' into release/1-6	5 years ago
Matt Keeler	4728329aeb	Various Gateway Fixes (#6093) ... * Ensure the mesh gateway configuration comes back in the api within each upstream * Add a test for the MeshGatewayConfig in the ToAPI functions * Ensure we don’t use gateways for dc local connections * Update the svc kind index for deletions * Replace the proxycfg.state cache with an interface for testing Also start implementing proxycfg state testing. * Update the state tests to verify some gateway watches for upstream-targets of a discovery chain.	5 years ago
Sarah Adams	ce3a6e8660	fix flaky test TestACLEndpoint_SecureIntroEndpoints_OnlyCreateLocalData (#6116) ... * fix test to write only to dc2 (typo) * fix retry behavior in existing test (was being used incorrectly)	5 years ago
R.B. Boyer	bcd2de3a2e	implement some missing service-router features and add more xDS testing (#6065) ... - also implement OnlyPassing filters for non-gateway clusters	5 years ago
R.B. Boyer	9138a97054	Fix bug in service-resolver redirects if the destination uses a default resolver. (#6122) ... Also: - add back an internal http endpoint to dump a compiled discovery chain for debugging purposes Before the CompiledDiscoveryChain.IsDefault() method would test: - is this chain just one resolver step? - is that resolver step just the default? But what I forgot to test: - is that resolver step for the same service that the chain represents? This last point is important because if you configured just one config entry: kind = "service-resolver" name = "web" redirect { service = "other" } and requested the chain for "web" you'd get back a **default** resolver for "other". In the xDS code the IsDefault() method is used to determine if this chain is "empty". If it is then we use the pre-discovery-chain logic that just uses data embedded in the Upstream object (and still lets the escape hatches function). In the example above that means certain parts of the xDS code were going to try referencing a cluster named "web..." despite the other parts of the xDS code maintaining clusters named "other...".	5 years ago
R.B. Boyer	67a36e3452	handle structs.ConfigEntry decoding similarly to api.ConfigEntry decoding (#6106) ... Both 'consul config write' and server bootstrap config entries take a decoding detour through mapstructure on the way from HCL to an actual struct. They both may take in snake_case or CamelCase (for consistency) so need very similar handling. Unfortunately since they are operating on mirror universes of structs (api.* vs structs.*) the code cannot be identitical, so try to share the kind-configuration and duplicate the rest for now.	5 years ago
Matt Keeler	6e65811db2	Envoy CLI bind addresses (#6107) ... * Ensure we MapWalk the proxy config in the NodeService and ServiceNode structs This gets rid of some json encoder errors in the catalog endpoints * Allow passing explicit bind addresses to envoy * Move map walking to the ConnectProxyConfig struct Any place where this struct gets JSON encoded will benefit as opposed to having to implement it everywhere. * Fail when a non-empty address is provided and not bindable * camel case * Update command/connect/envoy/envoy.go Co-Authored-By: Paul Banks <banks@banksco.de>	5 years ago
Freddy	5873c56a03	Flaky test overhaul (#6100)	5 years ago
Freddy	4033a4d632	Remove dummy config (#6121)	5 years ago