5524 Commits (920cc7c649225b52e1c45951e609c3d37a49324d)

Author	SHA1	Message	Date
Melissa Kam	b0e87dbe13	[CC-7049] Stop the HCP manager when link is deleted (#20351) ... * Add Stop method to telemetry provider Stop the main loop of the provider and set the config to disabled. * Add interface for telemetry provider Added for easier testing. Also renamed Run to Start, which better fits with Stop. * Add Stop method to HCP manager * Add manager interface, rename implementation Add interface for easier testing, rename existing Manager to HCPManager. * Stop HCP manager in link Finalizer * Attempt to cleanup if resource has been deleted The link should be cleaned up by the finalizer, but there's an edge case in a multi-server setup where the link is fully deleted on one server before the other server reconciles. This will cover the case where the reconcile happens after the resource is deleted. * Add a delete mananagement token function Passes a function to the HCP manager that deletes the management token that was initially created by the manager. * Delete token as part of stopping the manager * Lock around disabling config, remove descriptions	10 months ago
John Murret	7c6a3c83f2	NET-7165 - v2 - add service questions (#20390) ... * NET-7165 - v2 - add service questions * removing extraneous copied over code from autogen PR script. * fixing license checking	10 months ago
Melissa Kam	3b9bb8d6f9	[CC-7044] Start HCP manager as part of link creation (#20312) ... * Check for ACL write permissions on write Link eventually will be creating a token, so require acl:write. * Convert Run to Start, only allow to start once * Always initialize HCP components at startup * Support for updating config and client * Pass HCP manager to controller * Start HCP manager in link resource Start as part of link creation rather than always starting. Update the HCP manager with values from the link before starting as well. * Fix metrics sink leaked goroutine * Remove the hardcoded disabled hostname prefix The HCP metrics sink will always be enabled, so the length of sinks will always be greater than zero. This also means that we will also always default to prefixing metrics with the hostname, which is what our documentation states is the expected behavior anyway. * Add changelog * Check and set running status in one method * Check for primary datacenter, add back test * Clarify merge reasoning, fix timing issue in test * Add comment about controller placement * Expand on breaking change, fix typo in changelog	10 months ago
Matt Keeler	34a32d4ce5	Remove V2 PeerName field from pbresource.Tenancy (#19865) ... The peer name will eventually show up elsewhere in the resource. For now though this rips it out of where we don’t want it to be.	10 months ago
Dan Stough	0ca7313b07	feat(v2dns): add PTR query support (#20362)	10 months ago
Tyler Wendlandt	7e08d8988c	NET-5398: Update UI server to include if v2 is enabled (#20353) ... * Update ui server to include V2 Catalog flag * Fix typo	10 months ago
Nitya Dhanushkodi	0ec7bddb9a	[Net-5594][Net-7466] v2: Only route to endpoints that implement the port being routed to, and make xdscontroller and xdsv2 golden tests use tenancy (#20356) ... * If a workload does not implement a port, it should not be included in the list of endpoints for the Envoy cluster for that port. * Adds tenancy tests for xds controller and xdsv2 resource generation, and adds all those files. * The original change in this PR was for filtering the list of endpoints by the port being routed to (bullet 1). Since I made changes to sidecarproxycontroller golden files, I realized some of the golden files were unused because of the tenancy changes, so when I deleted those, that broke xds controller tests which weren't correctly using tenancy. So when I fixed that, then the xdsv2 tests broke, so I added tenancy support there too. So now, from sidecarproxy controller -> xds controller -> xdsv2 we now have tenancy support and all the golden files are lined up.	10 months ago
sarahalsmiller	37ebaa6920	Net 7155- Consul API Gateway Controller Stub Work (#20324) ... * API Gateway proto * fix lint issue * new line * run make proto format * checkpoint * stub * Update internal/mesh/internal/controllers/apigateways/controller.go	10 months ago
Luke Kysow	840f11a0c5	Change logging of registered v2 resource endpoints to add /api prefix (#20352) ... * Change logging of registered v2 resource endpoints to add /api prefix Previous: agent.http: Registered resource endpoint: endpoint=/demo/v1/executive New: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/executive This reduces confusion when attempting to call the APIs after looking at the logs.	10 months ago
Semir Patel	efdf80413c	resource: add MutateAndValidate endpoint (#20311)	10 months ago
Dan Stough	6828780131	feat(v2dns): add partial support for SOA records (#20320)	10 months ago
Melissa Kam	7900544249	[CC-7063] Fetch HCP agent bootstrap config in Link reconciler (#20306) ... * Move config-dependent methods to separate package In order to reuse the fetching and file creation part of the bootstrap package, move the code that would cause cyclical dependencies to a different package. * Export needed bootstrap methods and variables Also add back validating persisted config and update tests. * Add support to check for just management token Add a new method that fetches the bootstrap configuration only if there isn't a valid management token file instead of checking for all the hcp-config files. * Pass data dir as a dependency to link controller The link controller needs to check the data directory for the hcp-config files. * Fetch bootstrap config for token in controller Load the management token when reconciling a link resource, which will fetch the agent boostrap configuration if the token is not already persisted locally. Skip this step if the cluster is in read-only mode. * Validate resource ID format in link creation * Handle unauthorized and forbidden errors Check for 401 and 403s when making GNM requests, exit bootstrap fetch loop and return specific failure statuses for link. * Move test function to a testing file * Log load and status write errors	10 months ago
aahel	3446eb3b1b	added computed failover controller (#20329) ... * added computed failover controller * removed some uncessary changes * removed uncessary changes * minor refactor * minor refactor fmt * added copyright	10 months ago
skpratt	0abf8f8426	Net 5092/internal l7 traffic permissions (#20276) ... * wire up L7 Traffic Permissions * testing * update comment	10 months ago
skpratt	44bcda8523	Net 7074/decentralized exported services management (#20318) ... * Add decentralized management of V1 exported-services config entries using V2 multicluster resources. * cleanup --------- Co-authored-by: Matt Keeler <mjkeeler7@gmail.com>	10 months ago
Tauhid Anjum	5d294b26d3	NET-5824 Exported services api (#20015) ... * Exported services api implemented * Tests added, refactored code * Adding server tests * changelog added * Proto gen added * Adding codegen changes * changing url, response object * Fixing lint error by having namespace and partition directly * Tests changes * refactoring tests * Simplified uniqueness logic for exported services, sorted the response in order of service name * Fix lint errors, refactored code	10 months ago
Lord-Y	758ddf84e9	Case sensitive route match (#19647) ... Add case insensitive param on service route match This commit adds in a new feature that allows service routers to specify that paths and path prefixes should ignore upper / lower casing when matching URLs. Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>	10 months ago
Nick Cellino	34b343a980	Unconditionally add Access-Control-Expose-Headers HTTP header (#20220) ... * Unconditionally add Access-Control-Expose-Headers HTTP header * Return nil instead of err	10 months ago
Dan Stough	97ae244d8a	feat(v2dns): add grpc DNS support (#20296)	10 months ago
Semir Patel	6d9e8fdd05	resource: retry non-CAS deletes automatically (#20292)	10 months ago
R.B. Boyer	2e08a7e1c7	v2: prevent use of the v2 experiments in secondary datacenters for now (#20299) ... Ultimately we will have to rectify wan federation with v2 catalog adjacent experiments, but for now blanket prevent usage of the resource-apis, v2dns, and v2tenancy experiments in secondary datacenters.	10 months ago
Nick Cellino	37a5fddffa	Create HCP management token in HCP manager (#19830) ... * Create HCP management token in HCP manager * Change InitializeManagementToken to ManagementTokenUpserter * Implement and use management token upsert function * Fix race condition in test * Add idea for improvement as comment * Return early in upsertManagementToken if token exists	10 months ago
Melissa Kam	98c9702ba3	[CC-7031] Add initialization support to resource controllers (#20138) ... * Add Initializer to the controller The Initializer adds support for running any required initialization steps when the controller is first started. * Implement HCP Link initializer The link initializer will create a Link resource if the cloud configuration has been set. * Simplify retry logic and testing * Remove internal retry, replace with logging logic	10 months ago
Nick Cellino	fe678e9da1	Sync cluster attributes from GNM to Link resource (#20158) ... * Add 'GetCluster' function to HCP client * Sync cluster data inside Link controller * Add access mode to HCP Link * Sync AccessLevel property * Fix imports and remove outdated comments * Switch accessMode to access level * Add comment around HCPClientFn * Fix spacing in link.proto * Add helper for writing status. Fix reconciliation loop	10 months ago
Matt Keeler	f9c04881f9	Failover policy cache (#20244) ... * Migrate the Failover controller to use the controller cache * Remove the Catalog FailoverMapper and its usage in the mesh routes controller.	10 months ago
Dan Stough	0edfa74d15	feat(v2dns): recursor support (#20249) ... * feat(v2dns): recursor support * test: fix leaking test agent in dns svc test	10 months ago
Dhia Ayachi	d641998641	Fix to not create a watch to `Internal.ServiceDump` when mesh gateway is not used (#20168) ... This add a fix to properly verify the gateway mode before creating a watch specific to mesh gateways. This watch have a high performance cost and when mesh gateways are not used is not used. This also adds an optimization to only return the nodes when watching the Internal.ServiceDump RPC to avoid unnecessary disco chain compilation. As watches in proxy config only need the nodes.	10 months ago
John Murret	938d2315e0	DNS v2 - add virtual ip questions (#20245)	11 months ago
John Murret	bc4da5f5d6	check error in TestDNSCycleRecursorCheckAllFail before asserting response to stop panic in CI. (#20231)	11 months ago
Dan Stough	cb384ac068	feat(v2dns): addr. query support (#20224)	11 months ago
Melissa Kam	c112a6632d	[CC-7042] Update and enable the HCP metrics sink in the HCP manager (#20072) ... * Option to set HCP client at runtime Allows us to initially set a nil HCP client for the telemetry provider and update it later. * Set telemetry provider HCP client in HCP manager Set the telemetry provider as a dependency and pass it to the manager. Update the telemetry provider's HCP client when the HCP manager starts. * Add a provider interface for the metrics client This provider will allow us to configure and reconfigure the retryable HTTP client and the headers for the metrics client. * Move HTTP retryable client to separate file Copied directly from the metrics client. * Abstract HCP specific values in HTTP client Remove HCP specific references and instead initiate with a generic TLS configuration and authentication source. * Set up HTTP client and headers in the provider Move setup from the metrics client to the HCP telemetry provider. * Update the telemetry provider in the HCP manager Initialize the provider without the HCP configs and then update it in the HCP manager to enable it. * Improve test assertion, fix method comment * Move client provider to metrics client * Stop the manager on setup error * Add separate lock for http configuration * Start telemetry provider in HCP manager * Update HCP client and config as part of Run * Remove option to set config at initialization * Simplify and clean up setting HCP configs * Add test for telemetry provider Run method * Fix race condition * Use clone of HTTP headers * Only allow initial update and run once	11 months ago
Derek Menteer	b8b8ad46fc	Various race condition and test fixes. (#20212) ... * Increase timeouts for flakey peering test. * Various test fixes. * Fix race condition in reconcilePeering. This resolves an issue where a peering object in the state store was incorrectly mutated by a function, resulting in the test being flagged as failing when the -race flag was used.	11 months ago
John Murret	93e06b799e	v1 dns - add doc strings for functions and update function names to be consistent and more descriptive. (#20194) ... v1 dns - add doc strings for functions and update function names to be consistent and mre descriptive.	11 months ago
R.B. Boyer	7f9ed032fd	agent: remove data race in agent config (#20200) ... To fix an issue displaying the current reloaded config in the v1/agent/self endpoint #18681 caused the agent's internal config struct member to be deepcopied and replaced on reload. This is not safe because the field is not protected by a lock, nor should it be due to how it is accessed by the rest of the system. This PR does the same deepcopy, but into a new field solely for the point of capturing the current reloaded values for display purposes. If there has been no reload then the original config is used.	11 months ago
Matt Keeler	326c0ecfbe	In-Memory gRPC (#19942) ... * Implement In-Process gRPC for use by controller caching/indexing This replaces the pipe base listener implementation we were previously using. The new style CAN avoid cloning resources which our controller caching/indexing is taking advantage of to not duplicate resource objects in memory. To maintain safety for controllers and for them to be able to modify data they get back from the cache and the resource service, the client they are presented in their runtime will be wrapped with an autogenerated client which clones request and response messages as they pass through the client. Another sizable change in this PR is to consolidate how server specific gRPC services get registered and managed. Before this was in a bunch of different methods and it was difficult to track down how gRPC services were registered. Now its all in one place. * Fix race in tests * Ensure the resource service is registered to the multiplexed handler for forwarding from client agents * Expose peer streaming on the internal handler	11 months ago
John Murret	3fa4a21edd	remove the skipping of slow tests in go-tests-ce and go-test-enterprise (#20139) ... * remove the skipping of slow tests in go-tests-ce and go-test-enterprise * add license header	11 months ago
Dan Stough	d52e80b619	[OSS] feat: add experiments flag for v2 dns and skeleton interfaces (#20115) ... feat: add experiments flag for v2 dns and skeleton interfaces	11 months ago
loshz	7724bb88d5	[NET-6593] agent: check for minimum RSA key size (#20112) ... * agent: check for minimum RSA key size * add changelog * agent: add test for RSA generated key sizes * use constants in generating priv key func * update key size error message	11 months ago
Derek Menteer	131ef2a133	Fix broken tests. (#20134)	11 months ago
Derek Menteer	6854e1e90d	Fix broken tests. (#20130) ... This fixes some tests that were broken, but not caught, due to the CICD pipeline only running a subset of the overall tests on PRs.	11 months ago
Nick Cellino	0deebaf637	Add Link resource type and controller skeleton (#19788) ... * Add HCCLink resource type * Register HCCLink resource type with basic validation * Add validation for required fields * Add test for default ACLs * Add no-op controller for HCCLink * Add resource-apis semantic validation check in hcclink controller * Add copyright headers * Rename HCCLink to Link * Add hcp_cluster_url to link proto * Update 'disabled' reason with more detail * Update link status name to consul.io/hcp/link * Change link version from v1 to v2 * Use feature flag/experiment to enable v2 resources with HCP	11 months ago
John Murret	21e2bb2a67	Make DNS test run across a matrix of dns and catalog versions. (#20114) ... * Make DNS test run across a matrix of dns and catalog versions. * node tests * add version hcl config to service lookup tests	11 months ago
Melissa Kam	5dc8eabcce	[CC-7041] Update and start the SCADA provider in HCP manager (#19976) ... * Update SCADA provider version Also update mocks for SCADA provider. * Create SCADA provider w/o HCP config, then update Adds a placeholder config option to allow us to initialize a SCADA provider without the HCP configuration. Also adds an update method to then add the HCP configuration. We need this to be able to eventually always register a SCADA listener at startup before the HCP config values are known. * Pass cloud configuration to HCP manager Save the entire cloud configuration and pass it to the HCP manager. * Update and start SCADA provider in HCP manager Move config updating and starting to the HCP manager. The HCP manager will eventually be responsible for all processes that contribute to linking to HCP.	11 months ago
Ganesh S	0d57acc549	Add sameness group references in exported services controller (#20100)	11 months ago
John Murret	c12245be3c	Break up DNS tests into 3 files to help with GH UI and IDE issues. (#20103)	11 months ago
cskh	15b40f36f3	Use safeio to write server metadata file (#20101) ... * Use safeio to write server metadata file * guard the conversion	11 months ago
John Murret	7a410d7c5b	NET-6945 - Replace usage of deprecated Envoy field envoy.config.core.v3.HeaderValueOption.append (#20078) ... * NET-6945 - Replace usage of deprecated Envoy field envoy.config.core.v3.HeaderValueOption.append * update proto for v2 and then update xds v2 logic * add changelog * Update 20078.txt to be consistent with existing changelog entries * swap enum values tomatch envoy.	11 months ago
Dan Stough	073959866d	feat(v2): add consul service and workloads to catalog (#20077)	11 months ago
John Murret	d925e4b812	NET-6946 / NET-6941 - Replace usage of deprecated Envoy fields envoy.config.route.v3.HeaderMatcher.safe_regex_match and envoy.type.matcher.v3.RegexMatcher.google_re2 (#20013) ... * NET-6946 - Replace usage of deprecated Envoy field envoy.config.route.v3.HeaderMatcher.safe_regex_match * removing unrelated changes * update golden files * do not set engine type	11 months ago
John Murret	2f335113f8	NET-6943 - Replace usage of deprecated Envoy field envoy.config.router.v3.WeightedCluster.total_weight. (#20011)	11 months ago
John Murret	90cd56c5c3	NET-4774 - replace usage of deprecated Envoy field match_subject_alt_names (#19954)	11 months ago
John Murret	21ea5c92fd	NET-6944 - Replace usage of deprecated Envoy field envoy.extensions.filters.http.lua.v3.Lua.inline_code (#20012)	11 months ago
Nathan Coleman	ab60fec15a	[NET-6426] Add gateway proxy controller that generates empty proxy state template (#19901) ... * NET-6426 Create ProxyStateTemplate when reconciling MeshGateway resource * Add TODO for switching fetch method based on gateway type * Use gateway-kind in workload metadata instead of owner reference * Create ProxyStateTemplate builder for gatewayproxy controller * Update to use new controller interface * Add copyright headers * Set correct name for ProxyStateTemplate identity reference * Generate empty ProxyStateTemplate by fetching MeshGateway This cheats and looks up the MeshGateway directly. In the future, we will need a Workload => xGateway mapper * Specify owner reference when writing ProxyStateTemplate * Update dependency mapper to account for multiple controllers per resource type * Regenerate v2 resource dependencies map * Add helpful trace logs, tag TODOs with ticket identifiers	11 months ago
Nitya Dhanushkodi	9975b8bd73	[NET-5455] Allow disabling request and idle timeouts with negative values in service router and service resolver (#19992) ... * add coverage for testing these timeouts	11 months ago
cskh	cff872749d	agent: prevent empty server_metadata.json (#19935)	12 months ago
aahel	ae998a698a	added computed failover policy resource (#19975)	12 months ago
Derek Menteer	bbdbf3e4f8	Fix bug with prepared queries using sameness-groups. (#19970) ... This commit fixes an issue where the partition was not properly set on the peering query failover target created from sameness-groups. Before this change, it was always empty, meaning that the data would be queried with respect to the default partition always. This resulted in a situation where a PQ that was attempting to use a sameness-group for failover would select peers from the default partition, rather than the partition of the sameness-group itself.	12 months ago
aahel	a6496898de	added tenancy to TestBuildL4TrafficPermissions (#19932)	12 months ago
Matt Keeler	123bc95e1a	Add Common Controller Caching Infrastructure (#19767) ... * Add Common Controller Caching Infrastructure	12 months ago
Dhia Ayachi	f2b26ac194	Hash based config entry replication (#19795) ... * add a hash to config entries when normalizing * add GetHash and implement comparing hashes * only update if the Hash is different * only update if the Hash is different and not 0 * fix proto to include the Hash * fix proto gen * buf format * add SetHash and fix tests * fix config load tests * fix state test and config test * recalculate hash when restoring config entries * fix snapshot restore test * add changelog * fix missing normalize, fix proto indexes and add normalize test	12 months ago
Ronald	e13fbc743e	Remove warning for consul 1.17 deprecation (#19897)	12 months ago
Derek Menteer	dfab5ade50	Fix ClusterLoadAssignment timeouts dropping endpoints. (#19871) ... When a large number of upstreams are configured on a single envoy proxy, there was a chance that it would timeout when waiting for ClusterLoadAssignments. While this doesn't always immediately cause issues, consul-dataplane instances appear to consistently drop endpoints from their configurations after an xDS connection is re-established (the server dies, random disconnect, etc). This commit adds an `xds_fetch_timeout_ms` config to service registrations so that users can set the value higher for large instances that have many upstreams. The timeout can be disabled by setting a value of `0`. This configuration was introduced to reduce the risk of causing a breaking change for users if there is ever a scenario where endpoints would never be received. Rather than just always blocking indefinitely or for a significantly longer period of time, this config will affect only the service instance associated with it.	12 months ago
Derek Menteer	0ac958f27b	Fix xDS missing endpoint race condition. (#19866) ... This fixes the following race condition: - Send update endpoints - Send update cluster - Recv ACK endpoints - Recv ACK cluster Prior to this fix, it would have resulted in the endpoints NOT existing in Envoy. This occurred because the cluster update implicitly clears the endpoints in Envoy, but we would never re-send the endpoint data to compensate for the loss, because we would incorrectly ACK the invalid old endpoint hash. Since the endpoint's hash did not actually change, they would not be resent. The fix for this is to effectively clear out the invalid pending ACKs for child resources whenever the parent changes. This ensures that we do not store the child's hash as accepted when the race occurs. An escape-hatch environment variable `XDS_PROTOCOL_LEGACY_CHILD_RESEND` was added so that users can revert back to the old legacy behavior in the event that this produces unknown side-effects. Visit the following thread for some extra context on why certainty around these race conditions is difficult: https://github.com/envoyproxy/envoy/issues/13009 This bug report and fix was mostly implemented by @ksmiley with some minor tweaks. Co-authored-by: Keith Smiley <ksmiley@salesforce.com>	12 months ago
Thomas Eckert	8125a32a4e	Add CE version of Gateway Upstream Disambiguation (#19860) ... * Add CE version of gateway-upstream-disambiguation * Use NamespaceOrDefault and PartitionOrDefault * Add Changelog entry * Remove the unneeded reassignment * Use c.ID()	12 months ago
Dhia Ayachi	d93f7f730d	parse config protocol on write to optimize disco-chain compilation (#19829) ... * parse config protocol on write to optimize disco-chain compilation * add changelog	12 months ago
Jared Kirschner	d3e658b0e7	improve client RPC metrics consistency (#19721) ... The client.rpc metric now excludes internal retries for consistency with client.rpc.exceeded and client.rpc.failed. All of these metrics now increment at most once per RPC method call, allowing for accurate calculation of failure / rate limit application occurrence. Additionally, if an RPC fails because no servers are present, client.rpc.failed is now incremented.	12 months ago
Matt Keeler	efe279f802	Retry lint fixes (#19151) ... * Add a make target to run lint-consul-retry on all the modules * Cleanup sdk/testutil/retry * Fix a bunch of retry.Run* usage to not use the outer testing.T * Fix some more recent retry lint issues and pin to v1.4.0 of lint-consul-retry * Fix codegen copywrite lint issues * Don’t perform cleanup after each retry attempt by default. * Use the common testutil.TestingTB interface in test-integ/tenancy * Fix retry tests * Update otel access logging extension test to perform requests within the retry block	12 months ago
Ronald	dc02fa695f	[NET-6251] Nomad client templated policy (#19827)	12 months ago
Semir Patel	c1bbda8128	resource: block default namespace deletion + test refactorings (#19822)	12 months ago
lornasong	edf4610ed9	[Cloud][CC-6925] Updates to pushing server state (#19682) ... * Upgrade hcp-sdk-go to latest version v0.73 Changes: - go get github.com/hashicorp/hcp-sdk-go - go mod tidy * From upgrade: regenerate protobufs for upgrade from 1.30 to 1.31 Ran: `make proto` Slack: https://hashicorp.slack.com/archives/C0253EQ5B40/p1701105418579429 * From upgrade: fix mock interface implementation After upgrading, there is the following compile error: cannot use &mockHCPCfg{} (value of type *mockHCPCfg) as "github.com/hashicorp/hcp-sdk-go/config".HCPConfig value in return statement: *mockHCPCfg does not implement "github.com/hashicorp/hcp-sdk-go/config".HCPConfig (missing method Logout) Solution: update the mock to have the missing Logout method * From upgrade: Lint: remove usage of deprecated req.ServerState.TLS Due to upgrade, linting is erroring due to usage of a newly deprecated field 22:47:56 [consul]: make lint --> Running golangci-lint (.) agent/hcp/testing.go:157:24: SA1019: req.ServerState.TLS is deprecated: use server_tls.internal_rpc instead. (staticcheck) time.Until(time.Time(req.ServerState.TLS.CertExpiry)).Hours()/24, ^ * From upgrade: adjust oidc error message From the upgrade, this test started failing: === FAIL: internal/go-sso/oidcauth TestOIDC_ClaimsFromAuthCode/failed_code_exchange (re-run 2) (0.01s) oidc_test.go:393: unexpected error: Provider login failed: Error exchanging oidc code: oauth2: "invalid_grant" "unexpected auth code" Prior to the upgrade, the error returned was: ``` Provider login failed: Error exchanging oidc code: oauth2: cannot fetch token: 401 Unauthorized\nResponse: {\"error\":\"invalid_grant\",\"error_description\":\"unexpected auth code\"}\n ``` Now the error returned is as below and does not contain "cannot fetch token" ``` Provider login failed: Error exchanging oidc code: oauth2: "invalid_grant" "unexpected auth code" ``` * Update AgentPushServerState structs with new fields HCP-side changes for the new fields are in: https://github.com/hashicorp/cloud-global-network-manager-service/pull/1195/files * Minor refactor for hcpServerStatus to abstract tlsInfo into struct This will make it easier to set the same tls-info information to both - status.TLS (deprecated field) - status.ServerTLSMetadata (new field to use instead) * Update hcpServerStatus to parse out information for new fields Changes: - Improve error message and handling (encountered some issues and was confused) - Set new field TLSInfo.CertIssuer - Collect certificate authority metadata and set on TLSInfo.CertificateAuthorities - Set TLSInfo on both server.TLS and server.ServerTLSMetadata.InternalRPC * Update serverStatusToHCP to convert new fields to GNM rpc * Add changelog * Feedback: connect.ParseCert, caCerts * Feedback: refactor and unit test server status * Feedback: test to use expected struct * Feedback: certificate with intermediate * Feedback: catch no leaf, remove expectedErr * Feedback: update todos with jira ticket * Feedback: mock tlsConfigurator	12 months ago
aahel	7936e55807	added node health resource (#19803)	1 year ago
John Maguire	a0240e3794	[NET-5688] APIGateway UI Topology Fixes (#19657) ... * Update catalog and ui endpoints to show APIGateway in gateway service topology view * Added initial implementation for service view * updated ui * Fix topology view for gateways * Adding tests for gw controller * remove unused args * Undo formatting changes * Fix call sites for upstream/downstream gw changes * Add config entry tests * Fix function calls again * Move from ServiceKey to ServiceName, cleanup from PR review * Add additional check for length of services in bound apigateway for IsSame comparison * fix formatting for proto * gofmt * Add DeepCopy for retrieved BoundAPIGateway * gofmt * gofmt * Rename function to be more consistent	1 year ago
Thomas Eckert	419677cc9e	[NET-6420] Add MeshConfiguration Controller stub (#19745) ... * Add meshconfiguration/controller * Add MeshConfiguration Registration function * Fix the TODOs on the RegisterMeshGateway function * Call RegisterMeshConfiguration * Add comment to MeshConfigurationRegistration * Add a test for Reconcile and some comments	1 year ago
Semir Patel	5930748cb0	resource: ListByOwner returns empty list on non-existent tenancy (#19742)	1 year ago
Ronald	eded2ff347	[NET-6249] Add templated policies description (#19735)	1 year ago
Ronald	c1dbf00a85	NET-6251 API gateway templated policy (#19728)	1 year ago
Poonam Jadhav	78f918a103	feat: create a default namespace (#19681) ... * feat: create a default namespace on leader * refactor: add comment and move inittenancy to leader file * refactor: rephrase comment	1 year ago
Mike Nomitch	302f994410	[NET-6640] Adds "Policy" BindType to BindingRule (#19499) ... feat: add bind type of policy Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>	1 year ago
Semir Patel	75c2def1ca	resource: preserve deferred deletion metadata on non-CAS writes (#19674)	1 year ago
Ronald	ea0caa3e0f	[NET-6103] Enable query tokens by service name using templated policy (#19666)	1 year ago
John Murret	2591318c82	Skip tests with p95 greater than 30 seconds outside of main and release branches. (#19628) ... Skip tests with p95 greater than 30 seconds.	1 year ago
Semir Patel	1eed205286	resource: freeze resources after marked for deletion (4 of 5) (#19603)	1 year ago
Kumar Kavish	68e7f27fd2	[NET-6438] Add tenancy to xDS Tests (#19551) ... * [NET-6438] Add tenancy to xDS Tests * [NET-6438] Add tenancy to xDS Tests - Fixing imports * [NET-6438] Add tenancy to xDS Tests - Added cleanup post test run * [NET-6356] Add tenancy to xDS Tests - Added cleanup post test run * [NET-6438] Add tenancy to xDS Tests - using t.Cleanup instead of defer delete * [NET-6438] Add tenancy to xDS Tests - rebased * [NET-6438] Add tenancy to xDS Tests - rebased	1 year ago
aahel	005e1b9926	added exported svc controller (#19589) ... * added exported svc controller * added license headers	1 year ago
Nathan Coleman	40c57f10a0	NET-6391 Initialize controller for MeshGateway resource (#19552) ... * Generate resource_types for MeshGateway by specifying spec option * Register MeshGateway type w/ TODOs for hooks * Initialize controller for MeshGateway resources * Add meshgateway to list of v2 resource dependencies for golden test * Scope MeshGateway resource to partition	1 year ago
John Murret	780e91688d	Migrate remaining individual resource tests for service mesh to TestAllResourcesFromSnapshot (#19583) ... * migrate expose checks and paths tests to resources_test.go * fix failing expose paths tests * fix the way endpoint resources get created to make expose tests pass. * remove endpoint resources that are already inlined on local_app clusters * renaiming and comments * migrate remaining service mesh tests to resources_test.go * cleanup * update proxystateconverter to skip ading alpn to clusters and listener filterto match v1 behavior	1 year ago
Kumar Kavish	f09dbb99e9	[NET-6356] Add tenancy to Failover Tests (#19547) ... * [NET-6356] Add tenancy to Failover Tests * [NET-6438] Add tenancy to xDS Tests - Added cleanup post test run * [NET-6356] Add tenancy to failover Tests - using t.Cleanup instead of defer delete	1 year ago
John Murret	f5bf256425	Migrate individual resource tests for API Gateway to TestAllResourcesFromSnapshot (#19584) ... migrate individual api gateway tests to resources_test.go	1 year ago
John Murret	a94fa4c3ed	Migrate individual resource tests for Mesh Gateway to TestAllResourcesFromSnapshot (#19502) ... migrate mesh-gateway tests to resources_test.go	1 year ago
John Murret	4aa95f3d1f	Migrate individual resource tests for Ingress Gateway to TestAllResourcesFromSnapshot (#19506) ... migrate ingress-gateway tests to resources_test.go	1 year ago
John Murret	2553d6e8b9	Migrate individual resource tests for Terminating Gateway to TestAllResourcesFromSnapshot (#19505) ... migrate terminating-gateway tests to resources_test.go	1 year ago
John Murret	7de0b45ba4	Fix xds v2 from creating envoy endpoint resources when already inlined in the cluster (#19580) ... * migrate expose checks and paths tests to resources_test.go * fix failing expose paths tests * fix the way endpoint resources get created to make expose tests pass. * wip * remove endpoint resources that are already inlined on local_app clusters * renaiming and comments	1 year ago
John Murret	5aff19f9bc	Migrate individual resource tests for JWT Provider to TestAllResourcesFromSnapshot (#19511) ... migrate jwt provider tests to resources_test.go	1 year ago
John Murret	903ff7fccb	Migrate individual resource tests for custom configuration to TestAllResourcesFromSnapshot (#19512) ... * Configure TestAllResourcesFromSnapshot to run V2 tests * migrate custom configuration tests to resources_test.go	1 year ago
John Murret	09f73d1abf	Migrate individual resource tests for expose paths and checks to TestAllResourcesFromSnapshot (#19513) ... * migrate expose checks and paths tests to resources_test.go * fix failing expose paths tests	1 year ago
John Murret	7bc2581c81	Migrate individual resource tests for Discovery Chains to TestAllResourcesFromSnapshot (#19508) ... migrate disco chain tests to resources_test.go	1 year ago
John Murret	caaff73337	add DeliverLatest as common function for use by Manager and ProxyTracker Open (#19564) ... Open add DeliverLatest as common function for use by Manager and ProxyTracker	1 year ago
Derek Menteer	393f7a429b	Fix more test flakes (#19533) ... Fix flaky snapshot and metrics tests.	1 year ago
John Murret	f115cdb1d5	NET-6385 - Static routes that are inlined in listener filters are also created as a resource. (#19459) ... * cover all protocols in local_app golden tests * fix xds tests * updating latest * fix broken test * add sorting of routers to TestBuildLocalApp to get rid of the flaking * cover all protocols in local_app golden tests * cover all protocols in local_app golden tests * cover all protocols in local_app golden tests * process envoy resource by walking the map. use a map rather than array for envoy resource to prevent duplication. * cleanup. doc strings. * update to latest * fix broken test * update tests after adding sorting of routers in local_app builder tests * do not make endpoints for local_app * fix catalog destinations only by creating clusters for any cluster not already created by walking the graph. * Configure TestAllResourcesFromSnapshot to run V2 tests * wip * fix processing of failover groups * add endpoints and clusters for any clusters that were not created from walking the listener -> path * fix xds v2 golden files for clusters to include failover group clusters	1 year ago
Semir Patel	2da7dd077a	v2tenancy: register tenancy controller deps (#19531)	1 year ago
Derek Menteer	6baf695cd9	[NET-6459] Fix issue with wanfed lan ip conflicts. (#19503) ... Fix issue with wanfed lan ip conflicts. Prior to this commit, the connection pools were unaware which datacenter the connection was associated with. This meant that any time servers with overlapping LAN IP addresses and node shortnames existed, they would be incorrectly co-located in the same pool. Whenever this occurred, the servers would get stuck in an infinite loop of forwarding RPCs to themselves (rather than the intended remote DC) until they eventually run out of memory. Most notably, this issue can occur whenever wan federation through mesh gateways is enabled. This fix adds extra metadata to specify which DC the connection is associated with in the pool.	1 year ago
John Murret	74daaa5043	XDS V1 should not make runs for TCP Disco Chains. (#19496) ... * XDS V1 should not make runs for TCP Disco Chains. * update TestEnvoyExtenderWithSnapshot	1 year ago
Poonam Jadhav	c3c836edae	Net-6291/fix/watch resources (#19467) ... * fix: update watch endpoint to default based on scope * test: additional test * refactor: rename list validate function * refactor: rename validate<Op>Request() -> ensure<Op>RequestValid() for consistency	1 year ago
Semir Patel	ef35525cf1	resource: finalizer aware delete endpoint (2 of 5) (#19493) ... resource: make delete endpoint finalizer aware	1 year ago
John Murret	d94d316204	NET-6319 - L7 routes have statePrefix of upstream. and should have a full path (#19473)	1 year ago
Derek Menteer	8f4c43727d	[NET-5916] Fix locality-aware routing config and tests (CE) (#19483) ... Fix locality-aware routing config and tests	1 year ago
John Murret	77e9a50f8b	Source / local_app golden tests to include all protocols. (#19436) ... * cover all protocols in local_app golden tests * fix xds tests * updating latest * fix broken test * add sorting of routers to TestBuildLocalApp to get rid of the flaking	1 year ago
John Murret	f0cf8f2f40	NET-6294 - v1 Agentless proxycfg datasource errors after v2 changes (#19365)	1 year ago
Semir Patel	0abd96c0d9	resource: resource service now checks for `v2tenancy` feature flag (#19400)	1 year ago
Poonam Jadhav	1806bcb38c	test: add missing tests for list endpoint (#19364)	1 year ago
Ashesh Vidyut	0295b959c9	Net 5875 - Create the Exported Services Resources (#19117) ... * init * computed exported service * make proto * exported services resource * exported services test * added some tests and namespace exported service * partition exported services * computed service * computed services tests * register types * fix comment * make proto lint * fix proto format make proto * make codegen * Update proto-public/pbmulticluster/v1alpha1/computed_exported_services.proto Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * Update internal/multicluster/internal/types/computed_exported_services.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * using different way of resource creation in tests * make proto * fix computed exported services test * fix tests * differnet validation for computed services for ent and ce * Acls for exported services * added validations for enterprise features in ce * fix error * fix acls test * Update internal/multicluster/internal/types/validation_exported_services_ee.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * removed the create method * update proto * removed namespace * created seperate function for ce and ent * test files updated and validations fixed * added nil checks * fix tests * added comments * removed tenancy check * added mutation function * fix mutation method * fix list permissions in test * fix pr comments * fix tests * lisence * busl license * Update internal/multicluster/internal/types/helpers_ce.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * Update internal/multicluster/internal/types/helpers_ce.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * Update internal/multicluster/internal/types/helpers_ce.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * make proto * some pr comments addressed * some pr comments addressed * acls helper * some comment changes * removed unused files * fixes * fix function in file * caps * some positioing * added test for validation error * fix names * made valid a function * remvoed patch * removed mutations * v2 beta1 * v2beta1 * rmeoved v1alpha1 * validate error * merge ent * some nits * removed dup func * removed nil check --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Chris S. Kim	6360c745b5	Add clarification for route match behavior (#19363) ... * Add clarification for route match behavior * Update website/content/docs/connect/config-entries/service-defaults.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	1 year ago
Michael Zalimeni	a7803bd829	[NET-6305] xds: Ensure v2 route match and protocol are populated for gRPC (#19343) ... * xds: Ensure v2 route match is populated for gRPC Similar to HTTP, ensure that route match config (which is required by Envoy) is populated when default values are used. Because the default matches generated for gRPC contain a single empty `GRPCRouteMatch`, and that proto does not directly support prefix-based config, an interpretation of the empty struct is needed to generate the same output that the `HTTPRouteMatch` is explicitly configured to provide in internal/mesh/internal/controllers/routes/generate.go. * xds: Ensure protocol set for gRPC resources Add explicit protocol in `ProxyStateTemplate` builders and validate it is always set on clusters. This ensures that HTTP filters and `http2_protocol_options` are populated in all the necessary places for gRPC traffic and prevents future unintended omissions of non-TCP protocols. Co-authored-by: John Murret <john.murret@hashicorp.com> --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
Andrew Stucki	e414cbee4a	Use strict DNS for mesh gateways with hostnames (#19268) ... * Use strict DNS for mesh gateways with hostnames * Add changelog	1 year ago
John Murret	dc00be0ea8	NET-6081 - xds controller golden file inputs into xds resources - sources (#19250) ... * NET-5397 - wire up golden tests from sidecar-proxy controller for xds controller and xdsv2 * WIP * WIP * everything matching except leafCerts. need to mock those * single port destinations working except mixed destinations * golden test input to xds controller tests for destinations * proposed fix for failover group naming errors * clean up test to use helper. * clean up test to use helper. * fix test file * add docstring for test function. * add docstring for test function. * fix linting error * fixing test after route fix merged into main * first source test works * WIP * modify all source files * source tests pass * fixing tests after bug fix in main * got first destination working. * adding destinations * fix docstring for test * fixing tests after bug fix in main * adding source proxies * fixing tests after bug fix in main * got first destination working. * adding destinations * fix docstring for test * fixing tests after bug fix in main * got first destination working. * adding destinations * fix docstring for test * fixing tests after bug fix in main	1 year ago
John Murret	abbf85831f	NET-6080 - xds controller golden file inputs into xds resources - destinations (#19244) ... * NET-5397 - wire up golden tests from sidecar-proxy controller for xds controller and xdsv2 * WIP * WIP * everything matching except leafCerts. need to mock those * single port destinations working except mixed destinations * golden test input to xds controller tests for destinations * proposed fix for failover group naming errors * clean up test to use helper. * clean up test to use helper. * fix test file * add docstring for test function. * add docstring for test function. * fix linting error * fixing test after route fix merged into main * first source test works * WIP * modify all source files * source tests pass * fixing tests after bug fix in main * got first destination working. * adding destinations * fix docstring for test * fixing tests after bug fix in main	1 year ago
Derek Menteer	48c4a5b736	Add grpc keepalive configuration. (#19339) ... Prior to the introduction of this configuration, grpc keepalive messages were sent after 2 hours of inactivity on the stream. This posed issues in various scenarios where the server-side xds connection balancing was unaware that envoy instances were uncleanly killed / force-closed, since the connections would only be cleaned up after ~5 minutes of TCP timeouts occurred. Setting this config to a 30 second interval with a 20 second timeout ensures that at most, it should take up to 50 seconds for a dead xds connection to be closed.	1 year ago
Semir Patel	96606d114c	resource: default peername to local in list endpoints (#19340)	1 year ago
Dhia Ayachi	d5c9f11b59	Tenancy Bridge v2 (#19220) ... * tenancy bridge v2 for v2 resources * add missing copywrite headers	1 year ago
aahel	1280f45485	added ent to ce downgrade changes (#19311) ... * added ent to ce downgrade changes * added changelog * added busl headers	1 year ago
Chris S. Kim	9d00b13140	Vault CA bugfixes (#19285) ... * Re-add retry logic to Vault token renewal * Fix goroutine leak * Add test for detecting goroutine leak * Add changelog * Rename tests * Add comment	1 year ago
Michael Zalimeni	5e517c5980	[NET-6221] Ensure LB policy set for locality-aware routing (CE) (#19283) ... Ensure LB policy set for locality-aware routing (CE) `overprovisioningFactor` should be overridden with the expected value (100,000) when there are multiple endpoint groups. Update code and tests to enforce this. This is an Enterprise feature. This commit represents the CE portions of the change; tests are added in the corresponding `consul-enterprise` change.	1 year ago
Eric Haberkorn	f45be222bb	Prevent circular dependencies between v2 resources and generate a mermaid diagram with their dependencies (#19230)	1 year ago
John Maguire	b78465b491	[NET-5810] CE changes for multiple virtual hosts (#19246) ... CE changes for multiple virtual hosts	1 year ago
Semir Patel	ad177698f7	resource: enforce lowercase v2 resource names (#19218)	1 year ago
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143) ... This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
R.B. Boyer	20d1fb8c78	server: run the api checks against the path without params (#19205)	1 year ago
Dhia Ayachi	5fbf0c00d3	Add namespace read write tests (#19173)	1 year ago
Thomas Eckert	76c60fdfac	Golden File Tests for TermGW w/ Cluster Peering (#19096) ... Add intention to create golden file for terminating gateway peered trust bundle	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185) ... * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	25283f0ec2	get-envoy-bootstrap-params: when v2 is enabled, use computed proxy configuration (#19175)	1 year ago
Chris S. Kim	197bcd4164	Refactor connect_auth.go into agent_endpoint.go (#19166)	1 year ago
John Maguire	7a323c492b	[NET-5457] Golden Files for Multiple Virtual Hosts (#19131) ... * Add new golden file tests * Update with latest deterministic code	1 year ago
John Murret	6cbd417f29	NET-5822 - Add default outbound router in TProxy (#19087) ... * NET-5822 - Add default outbound router in TProxy * fixing connection timeout to be 5 s instead of 10 seconds	1 year ago
R.B. Boyer	b9ab63c55d	server: when the v2 catalog experiment is enabled reject api and rpc requests that are for the v1 catalog (#19129) ... When the v2 catalog experiment is enabled the old v1 catalog apis will be forcibly disabled at both the API (json) layer and the RPC (msgpack) layer. This will also disable anti-entropy as it uses the v1 api. This includes all of /v1/catalog/*, /v1/health/*, most of /v1/agent/*, /v1/config/*, and most of /v1/internal/*.	1 year ago
John Maguire	8bebfc147d	[NET-5457] Fix CE code for jwt multiple virtual hosts bug (#19123) ... * Fix CE code for jwt multiple virtual hosts bug * Fix struct definition * fix bug with always appending route to jwt config * Update comment to be correct * Update comment	1 year ago
Semir Patel	830c4ea81c	v2tenancy: cluster scoped reads (#19082)	1 year ago
Dhia Ayachi	226590541c	Activate verifier when running WAL with experimental features (#19102) ... * activate verifier when running WAL with experimental features * only change verifier parameters if it's disabled (default value)	1 year ago
Chris S. Kim	92ce814693	Remove old build tags (#19128)	1 year ago
Chris Thain	dcdf2fc6ba	Update Vault CA provider namespace configuration (#19095)	1 year ago
Ashesh Vidyut	a30ccdf5dc	NET-4135 - Fix NodeMeta filtering Catalog List Services API (#18322) ... * logs for debugging * Init * white spaces fix * added change log * Fix tests * fix typo * using queryoptionfilter to populate args.filter * tests * fix test * fix tests * fix tests * fix tests * fix tests * fix variable name * fix tests * fix tests * fix tests * Update .changelog/18322.txt Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> * fix change log * address nits * removed unused line * doing join only when filter has nodemeta * fix tests * fix tests * Update agent/consul/catalog_endpoint.go Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix tests * removed unwanted code --------- Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	1 year ago
Derek Menteer	af3439b53d	Ensure that upstream configuration is properly normalized. (#19076) ... This PR fixes an issue where upstreams did not correctly inherit the proper namespace / partition from the parent service when attempting to fetch the upstream protocol due to inconsistent normalization. Some of the merge-service-configuration logic would normalize to default, while some of the proxycfg logic would normalize to match the parent service. Due to this mismatch in logic, an incorrect service-defaults configuration entry would be fetched and have its protocol applied to the upstream.	1 year ago
Dhia Ayachi	ed882e2522	Make raft-wal default when `resource-apis` is active (#19090) ... Make raft-wal default when v2 catalog experiment is on	1 year ago
Thomas Eckert	342306c312	Allow connections through Terminating Gateways from peered clusters NET-3463 (#18959) ... * Add InboundPeerTrustBundle maps to Terminating Gateway * Add notify and cancelation of watch for inbound peer trust bundles * Pass peer trust bundles to the RBAC creation function * Regenerate Golden Files * add changelog, also adds another spot that needed peeredTrustBundles * Add basic test for terminating gateway with peer trust bundle * Add intention to cluster peered golden test * rerun codegen * update changelog * really update the changelog --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>	1 year ago
Chris S. Kim	aa526db225	Retry flaky tests (#19088)	1 year ago
Chris S. Kim	ad26494016	[CE] Add workload bind type and templated policy (#19077)	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
John Murret	d67e5c6e35	NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params (#19049) ... * NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params * gofmt file	1 year ago
Chris S. Kim	41e6f6cd8b	Reduce number of ports that consul test agents take (#19047)	1 year ago
sarahalsmiller	9addd9ed7c	[NET-5788] Fix needed for JWTAuth in Consul Enterprise (#19038) ... change needed for fix in consul-enterprise	1 year ago