5275 Commits (9addd9ed7cc3068735e31539c382ac4c2225ebc4)

Author	SHA1	Message	Date
sarahalsmiller	9addd9ed7c	[NET-5788] Fix needed for JWTAuth in Consul Enterprise (#19038) ... change needed for fix in consul-enterprise	1 year ago
Nitya Dhanushkodi	9a48266712	remove log (#19029)	1 year ago
Chris Thain	5e45db18b7	Include RequestTimeout in marshal/unmarshal of ServiceResolverConfigE… (#19031)	1 year ago
Eric Haberkorn	7ce6ebaeb3	Handle Traffic Permissions With Empty Sources Properly (#19024) ... Fix issues with empty sources * Validate that each permission on traffic permissions resources has at least one source. * Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error. ``` error= | rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation | caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation | caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules { ```	1 year ago
Iryna Shustava	06c15d0656	auth: register auth controllers with the server (#19000)	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
R.B. Boyer	7688178ad2	peerstream: fix flaky test related to autopilot integration (#18979)	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago
R.B. Boyer	ef6f2494c7	resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925) ... The ACLs.Read hook for a resource only allows for the identity of a resource to be passed in for use in authz consideration. For some resources we wish to allow for the current stored value to dictate how to enforce the ACLs (such as reading a list of applicable services from the payload and allowing service:read on any of them to control reading the enclosing resource). This change update the interface to usually accept a *pbresource.ID, but if the hook decides it needs more data it returns a sentinel error and the resource service knows to defer the authz check until after fetching the data from storage.	1 year ago
Nitya Dhanushkodi	0a11499588	net-5689 fix disabling panic threshold logic (#18958)	1 year ago
Chris S. Kim	565e79344f	Dump response body on fail (#18962)	1 year ago
Ronald	276c60a947	skip flaky test (#18949)	1 year ago
John Landa	9eaa8eb026	dns token (#17936) ... * dns token fix whitespace for docs and comments fix test cases fix test cases remove tabs in help text Add changelog Peering dns test Peering dns test Partial implementation of Peered DNS test Swap to new topology lib expose dns port for integration tests on client remove partial test implementation remove extra port exposure remove changelog from the ent pr Add dns token to set-agent-token switch Add enterprise golden file Use builtin/dns template in tests Update ent dns policy Update ent dns template test remove local gen certs fix templated policy specs * add changelog * go mod tidy	1 year ago
Dhia Ayachi	341dc28ff9	Add namespace proto and registration (#18848) ... * add namespace proto and registration * fix proto generation * add missing copywrite headers * fix proto linter errors * fix exports and Type export * add mutate hook and more validation * add more validation rules and tests * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * fix owner error and add test * remove ACL for now * add tests around space suffix prefix. * only fait when ns and ap are default, add test for it --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	d574473fd1	mesh: make FailoverPolicy work in xdsv2 and ProxyStateTemplate (#18900) ... Ensure that configuring a FailoverPolicy for a service that is reachable via a xRoute or a direct upstream causes an envoy aggregate cluster to be created for the original cluster name, but with separate clusters for each one of the possible destinations.	1 year ago
Ronald	c8299522b5	[NET-5332] Add nomad server templated policy (#18888) ... * [NET-5332] Add nomad server templated policy * slksfd	1 year ago
Nitya Dhanushkodi	3a2e62053a	v2: various fixes to make K8s tproxy multiport acceptance tests and manual explicit upstreams (single port) tests pass (#18874) ... Adding coauthors who mobbed/paired at various points throughout last week. Co-authored-by: Dan Stough <dan.stough@hashicorp.com> Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com> Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com> Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Michael Wilkerson <mwilkerson@hashicorp.com>	1 year ago
Nick Ethier	1a3081ab32	agent/config: prevent startup if resource-apis experiment and cloud are enabled (#18876)	1 year ago
Blake Covarrubias	019c62e1ba	xds: Use downstream protocol when connecting to local app (#18573) ... Configure Envoy to use the same HTTP protocol version used by the downstream caller when forwarding requests to a local application that is configured with the protocol set to either `http2` or `grpc`. This allows upstream applications that support both HTTP/1.1 and HTTP/2 on a single port to receive requests using either protocol. This is beneficial when the application primarily communicates using HTTP/2, but also needs to support HTTP/1.1, such as to respond to Kubernetes HTTP readiness/liveness probes. Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886) ... wire up v2 default traffic permissions	1 year ago
Iryna Shustava	212793a4ee	mesh: only build tproxy outbound listener once per destination (#18836) ... Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy. This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports). Also, black-hole traffic when there are no inbound ports other than mesh	1 year ago
Chris S. Kim	91e6c3a82f	Remove flaky test assertions (#18870)	1 year ago
Semir Patel	62796a1454	resource: mutate and validate before acls on write (#18868)	1 year ago
Ronald	49cb84297f	Move ACL templated policies to hcl files (#18853)	1 year ago
Andrew Stucki	087539fc7b	Fix gateway services cleanup where proxy deregistration happens after service deregistration (#18831) ... * Fix gateway services cleanup where proxy deregistration happens after service deregistration * Add test * Add changelog * Fix comment	1 year ago
Dhia Ayachi	4435e4a420	add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830) ... * add v2 tenancy bridge and a feature flag for v2 tenancy * move tenancy bridge v2 under resource package	1 year ago
Chris S. Kim	461549e304	Adjust metrics test (#18837)	1 year ago
skpratt	1fda2965e8	Allow empty data writes for resources (#18819) ... * allow nil data writes for resources * update demo to test valid type with no data	1 year ago
Ronald	aff13cd4c2	Use embedded strings for templated policies (#18829)	1 year ago
Eric Haberkorn	21fdbbabbc	Wire up traffic permissions (#18812) ... Wire up traffic permissions	1 year ago
Semir Patel	d3dad14030	resource: default peername to "local" for now (#18822)	1 year ago
R.B. Boyer	66e1cdf40c	mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752) ... Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.	1 year ago
Ronald	1afeb6e040	[NET-5334] Added CLI commands for templated policies (#18816)	1 year ago
Ronald	802122640b	[NET-5329] use acl templated policy under the hood for node/service identities (#18813)	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704) ... * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Chris S. Kim	d667cc3809	Fix flaky test (#18805)	1 year ago
Chris S. Kim	6748fac43d	Clean up resources in test (#18799)	1 year ago
Derek Menteer	02259ef964	Fix snapshot creation issue. (#18783) ... The renaming of files from oss -> ce caused incorrect snapshots to be created due to ce writes now happening prior to ent writes. When this happens various entities will attempt to be restored from the snapshot prior to a partition existing and will cause a panic to occur.	1 year ago
Chris S. Kim	4dfca64ded	Vault CA provider clean up previous default issuers (#18773)	1 year ago
Eric Haberkorn	12be06f8e5	Add V2 TCP traffic permissions (#18771) ... Add support for TCP traffic permissions	1 year ago
Chris S. Kim	d090668c37	Add workload identity ACL rules (#18769)	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) ... * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
Chris Thain	4724a4e169	Add Envoy golden test for OTEL access logging extension (#18760)	1 year ago
John Murret	62062fd4fd	NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606) ... * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go * NET-5132 - Configure multiport routing for connect proxies in TProxy mode * formatting golden files * reverting golden files and adding changes in manually. build implicit destinations still has some issues. * fixing files that were incorrectly repeating the outbound listener * PR comments * extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName) * removing address level filtering. * adding license to resources_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Ronald	9776c10efb	[NET-5333] Add api to read/list and preview templated policies (#18748)	1 year ago
Dhia Ayachi	b1688ad856	Run copyright after running deep-copy as part of the Makefile/CI (#18741) ... * execute copyright headers after performing deep-copy generation. * fix copyright install * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * rename steps to match codegen naming * remove copywrite install category --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707)	1 year ago
Iryna Shustava	1557e1d6a3	sidecar-proxy controller: Add support for transparent proxy (NET-5069) (#18458) ... This commit adds support for transparent proxy to the sidecar proxy controller. As we do not yet support inferring destinations from intentions, this assumes that all services in the cluster are destinations.	1 year ago
Nathan Coleman	ed79c60e78	NET-5530 Generate deep-copy code (#18730) ... * Generate deep-copy code * Undo license header removal	1 year ago
Ronald	40d7ebc318	[NET-5330] Support templated policies in Binding rules (#18719) ... * [NET-5330] Support templated policies in Binding rules * changelog for templated policy support in binding rules	1 year ago