53 Commits (92ce8146931e840a4cda795aa35d7445ce25ee5a)

Author	SHA1	Message	Date
R.B. Boyer	754ab9abf2	mesh: ensure we add the virtual port number for L7 implicit upstreams (#19085)	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
John Murret	d67e5c6e35	NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params (#19049) ... * NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params * gofmt file	1 year ago
Iryna Shustava	3ea6afb4d4	mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995)	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
R.B. Boyer	9e48607893	mesh: compute more of the xRoute features into ComputedRoutes (#18980) ... Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work: - DestinationPolicy defaults - more timeouts - load balancer policy - request/response header mutations - urlrewrite - GRPCRoute matches	1 year ago
R.B. Boyer	11d6b0df45	mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965) ... xRoute resource types contain a slice of parentRefs to services that they manipulate traffic for. All xRoutes that have a parentRef to given Service will be merged together to generate a ComputedRoutes resource name-aligned with that Service. This means that a write of an xRoute with 2 parent ref pointers will cause at most 2 reconciles for ComputedRoutes. If that xRoute's list of parentRefs were ever to be reduced, or otherwise lose an item, that subsequent map event will only emit events for the current set of refs. The removed ref will not cause the generated ComputedRoutes related to that service to be re-reconciled to omit the influence of that xRoute. To combat this, we will store on the ComputedRoutes resource a BoundResources []*pbresource.Reference field with references to all resources that were used to influence the generated output. When the routes controller reconciles, it will use a bimapper to index this influence, and the dependency mappers for the xRoutes will look themselves up in that index to discover additional (former) ComputedRoutes that need to be notified as well.	1 year ago
R.B. Boyer	633c6c9458	mesh: add ACL checks for xRoute resources (#18926) ... xRoute resources are not name-aligned with the Services they control. They have a list of "parent ref" services that they alter traffic flow for, and they contain a list of "backend ref" services that they direct that traffic to. The ACLs should be: - list: (default) - read: - ALL service:<parent_ref_service>:read - write: - ALL service:<parent_ref_service>:write - ALL service:<backend_ref_service>:read	1 year ago
R.B. Boyer	43a8dbb188	mesh: add ACL checks for DestinationPolicy resources (#18920) ... DestinationPolicy resources are name-aligned with the Service they control. The ACLs should be: - list: (default) - read: service:<resource_name>:read - write: service:<resource_name>:write	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago
R.B. Boyer	ef6f2494c7	resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925) ... The ACLs.Read hook for a resource only allows for the identity of a resource to be passed in for use in authz consideration. For some resources we wish to allow for the current stored value to dictate how to enforce the ACLs (such as reading a list of applicable services from the payload and allowing service:read on any of them to control reading the enclosing resource). This change update the interface to usually accept a *pbresource.ID, but if the hook decides it needs more data it returns a sentinel error and the resource service knows to defer the authz check until after fetching the data from storage.	1 year ago
Derek Menteer	eb7e20307c	[NET-5589] Add jitter to xds v2 leaf cert watches (#18940) ... Add jitter to xds v2 leaf cert watches.	1 year ago
Eric Haberkorn	f87ae3636c	Fix V2 Wildcard RBAC Regular Expressions (#18941) ... fix wildcard rbac regular expressions	1 year ago
Derek Menteer	d4ed3047f8	[NET-5589] Optimize leaf watch diff on xds controller. (#18921) ... Optimize leaf watch diff on xds controller.	1 year ago
John Murret	700d1bb37c	NET-5131 - support multiple ported upstreams tests (#18923) ... * add multiple upstream ports to golden file test for destination builder * NET-5131 - add unit tests for multiple ported upstreams * fix merge conflicts	1 year ago
R.B. Boyer	d574473fd1	mesh: make FailoverPolicy work in xdsv2 and ProxyStateTemplate (#18900) ... Ensure that configuring a FailoverPolicy for a service that is reachable via a xRoute or a direct upstream causes an envoy aggregate cluster to be created for the original cluster name, but with separate clusters for each one of the possible destinations.	1 year ago
Nitya Dhanushkodi	3a2e62053a	v2: various fixes to make K8s tproxy multiport acceptance tests and manual explicit upstreams (single port) tests pass (#18874) ... Adding coauthors who mobbed/paired at various points throughout last week. Co-authored-by: Dan Stough <dan.stough@hashicorp.com> Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com> Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com> Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Michael Wilkerson <mwilkerson@hashicorp.com>	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886) ... wire up v2 default traffic permissions	1 year ago
Iryna Shustava	212793a4ee	mesh: only build tproxy outbound listener once per destination (#18836) ... Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy. This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports). Also, black-hole traffic when there are no inbound ports other than mesh	1 year ago
R.B. Boyer	dabbc9627b	mesh: normalize/default/validate tenancy components of mesh internal References (#18827) ... HTTPRoute, GRPCRoute, TCPRoute, and Upstreams resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
R.B. Boyer	696aa1bbd2	mesh: update xds controller to synthesize empty endpoints when no endpoints ref is found (#18835)	1 year ago
R.B. Boyer	5cde50dee7	mesh: prevent writing a ComputedRoutes with no ported configs (#18833)	1 year ago
Iryna Shustava	6838441c54	Default to tcp protocol when workload protocol is unspecified (#18824)	1 year ago
Eric Haberkorn	21fdbbabbc	Wire up traffic permissions (#18812) ... Wire up traffic permissions	1 year ago
R.B. Boyer	9c1a1ffcde	mesh: call the right mapper (#18818)	1 year ago
R.B. Boyer	66e1cdf40c	mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752) ... Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.	1 year ago
Eric Haberkorn	12be06f8e5	Add V2 TCP traffic permissions (#18771) ... Add support for TCP traffic permissions	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) ... * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
R.B. Boyer	89e6725eee	mesh: create new routes-controller to reconcile xRoute types into a ComputedRoutes resource (#18460) ... This new controller produces an intermediate output (ComputedRoutes) that is meant to summarize all relevant xRoutes and related mesh configuration in an easier-to-use format for downstream use to construct the ProxyStateTemplate. It also applies status updates to the xRoute resource types to indicate that they are themselves semantically valid inputs.	1 year ago
John Murret	62062fd4fd	NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606) ... * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go * NET-5132 - Configure multiport routing for connect proxies in TProxy mode * formatting golden files * reverting golden files and adding changes in manually. build implicit destinations still has some issues. * fixing files that were incorrectly repeating the outbound listener * PR comments * extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName) * removing address level filtering. * adding license to resources_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Dhia Ayachi	b1688ad856	Run copyright after running deep-copy as part of the Makefile/CI (#18741) ... * execute copyright headers after performing deep-copy generation. * fix copyright install * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * rename steps to match codegen naming * remove copywrite install category --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707)	1 year ago
John Murret	3e78b4cf34	Prefix sidecar proxy test files with source and destination. (#18620) ... * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Iryna Shustava	1557e1d6a3	sidecar-proxy controller: Add support for transparent proxy (NET-5069) (#18458) ... This commit adds support for transparent proxy to the sidecar proxy controller. As we do not yet support inferring destinations from intentions, this assumes that all services in the cluster are destinations.	1 year ago
R.B. Boyer	acd9b3d1c4	test: update sidecarproxy/builder golden tests to use determinstic golden data (#18703)	1 year ago
Iryna Shustava	3c70e14713	sidecar-proxy controller: L4 controller with explicit upstreams (NET-3988) (#18352) ... * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * This commit also changes service endpoints to include workload identity. This made the implementation a bit easier as we don't need to look up as many workloads and instead rely on endpoints data.	1 year ago
Semir Patel	b96cff7436	resource: Require scope for resource registration (#18635)	1 year ago
Ashwin Venkatesh	797e42dc24	Watch the ProxyTracker from xDS controller (#18611)	1 year ago
John Murret	0e606504bc	NET-4944 - wire up controllers with proxy tracker (#18603) ... Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
John Murret	051f250edb	NET-5338 - NET-5338 - Run a v2 mode xds server (#18579) ... * NET-5338 - NET-5338 - Run a v2 mode xds server * fix linting	1 year ago
R.B. Boyer	8a931241f2	chore: fix missing/incorrect license headers (#18555)	1 year ago
Ashwin Venkatesh	4f9955d91e	Update trust bundle into proxy-state-template (#18550)	1 year ago
R.B. Boyer	17667a1c75	mesh: adding type aliases for mesh resource usage (#18448) ... Introduces some simple type aliases for DecodedResource[*X] wrappers for each type which cut down on the verbosity	1 year ago
Ashwin Venkatesh	0d60380214	xds controller: resolve ServiceEndpoints references in ProxyStateTemp… (#18544) ... xds controller: resolve ServiceEndpoints references in ProxyStateTemplate	1 year ago
R.B. Boyer	55723c541e	mesh: add validation for the new pbmesh resources (#18410) ... Adds validation for HTTPRoute, GRPCRoute, TCPRoute, DestinationPolicy, and ComputedRoutes.	1 year ago
Semir Patel	217107f627	resource: Make resource list tenancy aware (#18475)	1 year ago
hashicorp-copywrite[bot]	5fb9df1640	[COMPLIANCE] License changes (#18443) ... * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	1 year ago
Semir Patel	bee12c6b1f	resource: Make resource write tenancy aware (#18423)	1 year ago
Semir Patel	63cc037110	resource: Make resource read tenancy aware (#18397)	1 year ago
R.B. Boyer	9c227e2c36	mesh: adding the protobuf types and resources backing mesh config v2 (#18351)	1 year ago