16211 Commits (9f629ae7e564691e50ff0ff32fa86cdb0c170309)

 

All Branches   

Search

Author	SHA1	Message	Date
Daniel Nephin	447097b166	ca: make test naming consistent ... While working on the CA system it is important to be able to run all the tests related to the system, without having to wait for unrelated tests. There are many slow and unrelated tests in agent/consul, so we need some way to filter to only the relevant tests. This PR renames all the CA system related tests to start with either `TestCAMananger` for tests of internal operations that don't have RPC endpoint, or `TestConnectCA` for tests of RPC endpoints. This allows us to run all the test with: go test -run 'TestCAMananger|TestConnectCA' ./agent/consul The test naming follows an undocumented convention of naming tests as follows: Test[<struct name>_]<function name>[_<test case description>] I tried to always keep Primary/Secondary at the end of the description, and _Vault_ has to be in the middle because of our regex to run those tests as a separate CI job. You may notice some of the test names changed quite a bit. I did my best to identify the underlying method being tested, but I may have been slightly off in some cases.	3 years ago
FFMMM	384d497f26	add MustRevalidate flag to connect_ca_leaf cache type; always use on non-blocking queries (#11693) ... * always use MustRevalidate on non-blocking queries for connect ca leaf Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update agent/agent_endpoint_test.go Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	28a8a64019	ca: make getLeafSigningCertFromRoot safer ... As a method on the struct type this would not be safe to call without first checking c.isIntermediateUsedToSignLeaf. So for now, move this logic to the CAMananger, so that it is always correct.	3 years ago
Daniel Nephin	b29faa3e50	ca: fix stored CARoot representation with Vault provider ... We were not adding the local signing cert to the CARoot. This commit fixes that bug, and also adds support for fixing existing CARoot on upgrade. Also update the tests for both primary and secondary to be more strict. Check the SigningKeyID is correct after initialization and rotation.	3 years ago
Dan Upton	bf56a2c495	Rename `agent_master` ACL token in the API and CLI (#11669)	3 years ago
Dhia Ayachi	9705105311	fix changelog file name (#11710)	3 years ago
Dhia Ayachi	210cdd3e6f	add changelog (#11708)	3 years ago
Dan Upton	d8afd2f6c8	Rename `master` and `agent_master` ACL tokens in the config file format (#11665)	3 years ago
Chris S. Kim	54e4d1b7b2	ENT to OSS sync (#11703)	3 years ago
R.B. Boyer	db91cbf484	auto-config: ensure the feature works properly with partitions (#11699)	3 years ago
Iryna Shustava	ffca66d5df	Update issue templates to link to consul-k8s instead of consul-helm (#11701)	3 years ago
Paul Banks	1d85afeed4	Reformatting suggestions from review	3 years ago
Paul Banks	d5a93d6b88	Apply suggestions from code review ... Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Paul Banks	46849a63f9	Apply suggestions from code review ... Co-authored-by: mrspanishviking <kcardenas@hashicorp.com>	3 years ago
Paul Banks	fcfedfdb5d	Add documentation for SDS support in ingress gateways.	3 years ago
Heronimus Tresy	d866e51bd4	docs: community tools - add string2files consul-template plugin (#11675)	3 years ago
John Cowen	4e0507aed3	ui: Don't cache event sources following a 401 (#11681)	3 years ago
John Cowen	f3d9565277	ui: Refactor KV and Lock Sessions following partitions update (#11666) ... This commit uses all our new ways of doing things to Lock Sessions and their interactions with KV and Nodes. This is mostly around are new under-the-hood things, but also I took the opportunity to upgrade some of the CSS to reuse some of our CSS utils that have been made over the past few months (%csv-list and %horizontal-kv-list). Also added (and worked on existing) documentation for Lock Session related components.	3 years ago
John Cowen	5ad82693d8	ui: Don't check global session permissions for a single session (#11657)	3 years ago
John Cowen	b5c8af4580	ui: Add `Service.Partition` as available variable for dashboard urls (#11654)	3 years ago
John Cowen	bda64f98b3	ui: Don't show policy datacenter selector for non-default partitions (#11656)	3 years ago
John Cowen	26341f0b05	ui: Move nspace CRUD to use the same approach as partitions (#11633) ... This sounds a bit 'backwards' as the end goal here is to add an improved UX to partitions, not namespaces. The reason for doing it this way is that Namespaces already has a type of 'improved UX' CRUD in that it has one to many relationship in the form when saving your namespaces (the end goal for partitions). In moving Namespaces to use the same approach as partitions we: - Ensure the new approach works with one-to-many forms. - Test the new approach without writing a single test (we already have a bunch of tests for namespaces which are now testing the approach used by both namespaces and partitions) Additionally: - Fixes issue with missing default nspace in the nspace selector - In doing when checking to see that things where consistent between the two, I found a few little minor problems with the Admin Partition CRUD so fixed those up here also. - Removed the old style Nspace notifications	3 years ago
Daniel Nephin	32ef9c5d5c	ca: add some godoc and func for finding leaf signing cert ... This will be used in a follow up commit.	3 years ago
Daniel Nephin	4185045a7f	sdk/freeport: rename Port to GetOne ... For better consistency with GetN	3 years ago
trujillo-adam	cef938e620	Merge pull request #11558 from hashicorp/docs/admin-partitions-service-exports-configuration-entry ... Admin partition docs: cross-partition support beta2/3	3 years ago
trujillo-adam	0fb360211a	addtional feedback; added PartitionExports to CRDs section	3 years ago
Chris S. Kim	56fab21582	Refactor test helper (#11689) ... Allow custom ACL root tokens to be passed	3 years ago
Chris S. Kim	36246c5791	acl: Fill authzContext from token in Coordinate endpoints (#11688)	3 years ago
Daniel Nephin	ba41db5c4e	sdk: upgrade freeport godoc ... To clarify how it works, and when it is important to use.	3 years ago
trujillo-adam	632e4bd35c	applied additional feedback	3 years ago
David Yu	29c791c90e	docs: Notes about WAN Federation when using Vault as Connect CA (#11143) ... * docs: Notes about WAN Federation when using Vault as Connect CA * Apply suggestions from code review Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/connect/ca/vault.mdx Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/connect/ca/vault.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/connect/ca/vault.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update vault.mdx * Update vault.mdx Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Daniel Nephin	33e8c10583	Merge pull request #11673 from hashicorp/dnephin/ca-remove-raft-apply-resp-err-handle ... ca: clean up unnecessary raft.Apply response checking	3 years ago
freddygv	7efe3d8c77	Rename partition CLI command	3 years ago
freddygv	dd662d7058	Move ent config test to ent file	3 years ago
freddygv	5e1f7b7c36	Prevent partition-exports entry from OSS usage ... Validation was added on the config entry kind since that is called when validating config entries to bootstrap via agent configuration and when applying entries via the config RPC endpoint.	3 years ago
Daniel Nephin	e8312d6b5a	testing: remove unnecessary calls to freeport ... Previously we believe it was necessary for all code that required ports to use freeport to prevent conflicts. https://github.com/dnephin/freeport-test shows that it is actually save to use port 0 (`127.0.0.1:0`) as long as it is passed directly to `net.Listen`, and the listener holds the port for as long as it is needed. This works because freeport explicitly avoids the ephemeral port range, and port 0 always uses that range. As you can see from the test output of https://github.com/dnephin/freeport-test, the two systems never use overlapping ports. This commit converts all uses of freeport that were being passed directly to a net.Listen to use port 0 instead. This allows us to remove a bit of wrapping we had around httptest, in a couple places.	3 years ago
Daniel Nephin	5a61893642	testing: use httptest with freeport	3 years ago
Daniel Nephin	d795a73f78	testing: use the new freeport interfaces	3 years ago
Daniel Nephin	56f9238d15	go-sso: remove returnFunc now that freeport handles return	3 years ago
Daniel Nephin	8c7475d95e	sdk: add freeport functions that use t.Cleanup	3 years ago
Daniel Nephin	59204598c8	ca: clean up unnecessary raft.Apply response checking ... In d2ab767fef raftApply was changed to handle this check in a single place, instad of having every caller check it. It looks like these few places were missed when I did that clean up. This commit removes the remaining resp.(error) checks, since they are all no-ops now.	3 years ago
Daniel Nephin	52f0853ff9	Merge pull request #11339 from hashicorp/dnephin/ca-manager-isolate-secondary-2 ... ca: reduce use of state in the secondary	3 years ago
Daniel Nephin	91a0c25932	ca: remove state check in secondarySetPrimaryRoots ... This function is only ever called from operations that have already acquired the state lock, so checking the value of state can never fail. This change is being made in preparation for splitting out a separate type for the secondary logic. The state can't easily be shared, so really only the expored top-level functions should acquire the 'state lock'.	3 years ago
Daniel Nephin	f1944458e4	ca: remove actingSecondaryCA ... This commit removes the actingSecondaryCA field, and removes the stateLock around it. This field was acting as a proxy for providerRoot != nil, so replace it with that check instead. The two methods which called secondarySetCAConfigured already set the state, so checking the state again at this point will not catch runtime errors (only programming errors, which we can catch with tests). In general, handling state transitions should be done on the "entrypoint" methods where execution starts, not in every internal method. This is being done to remove some unnecessary references to c.state, in preparations for extracting types for primary/secondary.	3 years ago
Daniel Nephin	238a4f13c8	Merge pull request #11660 from hashicorp/dnephin/ca-reduce-consul-provider-state-iface ... ca: reduce consul provider backend interface a bit	3 years ago
Daniel Nephin	a631378008	Merge pull request #11468 from hashicorp/dnephin/acl-docs-namespace-rules ... docs: update docs about namespace default policy/role	3 years ago
Daniel Nephin	7bfe50a914	docs: update docs about namespace default policy/role ... To include details about the permissions the ACL token must have to perform the request.	3 years ago
Daniel Nephin	b92084b8e8	ca: reduce consul provider backend interface a bit ... This makes it easier to fake, which will allow me to use the ConsulProvider as an 'external PKI' to test a customer setup where the actual root CA is not the root we use for the Consul CA. Replaces a call to the state store to fetch the clusterID with the clusterID field already available on the built-in provider.	3 years ago
John Cowen	f7b8df281b	ui: Add `Service.Namespace` variable to dashboard URL templates (#11640) ... We currently allow only Datacenter, Service.Name, this PR adds Service.Namespace.	3 years ago
John Cowen	3f131dcf34	ui: Notifications re-organization/re-style (#11577) ... - Moves where they appear up to the <App /> component. - Instead of a <Notification /> wrapping component to move whatever you use for a notification up to where they need to appear (via ember-cli-flash), we now use a {{notification}} modifier now we have modifiers. - Global notifications/flashes are no longer special styles of their own. You just use the {{notification}} modifier to hoist whatever component/element you want up to the top of the page. This means we can re-use our existing <Notice /> component for all our global UI notifications (this is the user visible change here)	3 years ago