845 Commits (a33b224a55fb570f4775bb8944eb0e39a4b680c7)

Author	SHA1	Message	Date
Eric Haberkorn	53cdda8d17	Fix a bug with disco chain config entry fetching (#17078) ... Before this change, we were not fetching service resolvers (and therefore service defaults) configuration entries for services on members of sameness groups.	2 years ago
Eric Haberkorn	b1fae05983	Add sameness groups to service intentions. (#17064)	2 years ago
Paul Glass	f4406e69b9	[NET-3091] Update service intentions to support jwt provider references (#17037) ... * [NET-3090] Add new JWT provider config entry * Add initial test cases * update validations for jwt-provider config entry fields * more validation * start improving tests * more tests * Normalize * Improve tests and move validate fns * usage test update * Add split between ent and oss for partitions * fix lint issues * Added retry backoff, fixed tests, removed unused defaults * take into account default partitions * use countTrue and add aliases * omit audiences if empty * fix failing tests * add omit-entry * Add JWT intentions * generate proto * fix deep copy issues * remove extra field * added some tests * more tests * add validation for creating existing jwt * fix nil issue * More tests, fix conflicts and improve memdb call * fix namespace * add aliases * consolidate errors, skip duplicate memdb calls * reworked iteration over config entries * logic improvements from review --------- Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>	2 years ago
Paul Glass	ac200cfec8	[NET-3090] Add new JWT provider config entry (#17036) ... * [NET-3090] Add new JWT provider config entry * Add initial test cases * update validations for jwt-provider config entry fields * more validation * start improving tests * more tests * Normalize * Improve tests and move validate fns * usage test update * Add split between ent and oss for partitions * fix lint issues * Added retry backoff, fixed tests, removed unused defaults * take into account default partitions * use countTrue and add aliases * omit audiences if empty * fix failing tests * add omit-entry * update copyright headers ids --------- Co-authored-by: Ronald Ekambi <ronekambi@gmail.com> Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>	2 years ago
Paul Glass	77ecff3209	Permissive mTLS (#17035) ... This implements permissive mTLS , which allows toggling services into "permissive" mTLS mode. Permissive mTLS mode allows incoming "non Consul-mTLS" traffic to be forward unmodified to the application. * Update service-defaults and proxy-defaults config entries with a MutualTLSMode field * Update the mesh config entry with an AllowEnablingPermissiveMutualTLS field and implement the necessary validation. AllowEnablingPermissiveMutualTLS must be true to allow changing to MutualTLSMode=permissive, but this does not require that all proxy-defaults and service-defaults are currently in strict mode. * Update xDS listener config to add a "permissive filter chain" when MutualTLSMode=permissive for a particular service. The permissive filter chain matches incoming traffic by the destination port. If the destination port matches the service port from the catalog, then no mTLS is required and the traffic sent is forwarded unmodified to the application.	2 years ago
Andrei Komarov	eb9f671eaf	api: enable query options on agent force-leave endpoint (#15987)	2 years ago
Derek Menteer	87324c9ec8	Add PrioritizeByLocality to config entries. (#17007) ... This commit adds the PrioritizeByLocality field to both proxy-config and service-resolver config entries for locality-aware routing. The field is currently intended for enterprise only, and will be used to enable prioritization of service-mesh connections to services based on geographical region / zone.	2 years ago
Eric Haberkorn	6bab6696cc	add sameness to exported services structs in the api package (#16984)	2 years ago
Chris Thain	175bb1a303	Wasm Envoy HTTP extension (#16877)	2 years ago
malizz	fc64a702f4	add region field (#16825) ... * add region field * fix syntax error in test file * go fmt * go fmt * remove test	2 years ago
Eric Haberkorn	a6d69adcf5	Add default resolvers to disco chains based on the default sameness group (#16837)	2 years ago
Poonam Jadhav	3e69ff1cd2	fix: export ReadWriteRatesConfig struct as it needs to referenced from consul-k8s (#16766)	2 years ago
Ronald	4b2137c2fa	Add copyright headers for acl, api and bench folders (#16706) ... * copyright headers for agent folder * Ignore test data files * fix proto files and remove headers in agent/uiserver folder * ignore deep-copy files * copyright headers for agent folder * fix merge conflicts * copyright headers for agent folder * Ignore test data files * fix proto files * ignore agent/uiserver folder for now * copyright headers for agent folder * Add copyright headers for acl, api and bench folders	2 years ago
Michael Wilkerson	e5d58c59c9	changes to support new PQ enterprise fields (#16793)	2 years ago
malizz	a168d0e667	add failover policy to ProxyConfigEntry in api (#16759) ... * add failover policy to ProxyConfigEntry in api * update docs	2 years ago
cskh	2f13f75d18	chore: replace hardcoded node name with a constant (#16692)	2 years ago
Eric Haberkorn	eaa39f4ef5	add sameness group support to service resolver failover and redirects (#16664)	2 years ago
wangxinyi7	152c75349e	net 2731 ip config entry OSS version (#16642) ... * ip config entry * name changing * move to ent * ent version * renaming * change format * renaming * refactor * add default values	2 years ago
Derek Menteer	f2902e6608	Add sameness-group configuration entry. (#16608) ... This commit adds a sameness-group config entry to the API and structs packages. It includes some validation logic and a new memdb index that tracks the default sameness-group for each partition. Sameness groups will simplify the effort of managing failovers / intentions / exports for peers and partitions. Note that this change purely to introduce the configuration entry and does not include the full functionality of sameness-groups.	2 years ago
Ashvitha	f95ffe0355	Allow HCP metrics collection for Envoy proxies ... Co-authored-by: Ashvitha Sridharan <ashvitha.sridharan@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com> Add a new envoy flag: "envoy_hcp_metrics_bind_socket_dir", a directory where a unix socket will be created with the name `<namespace>_<proxy_id>.sock` to forward Envoy metrics. If set, this will configure: - In bootstrap configuration a local stats_sink and static cluster. These will forward metrics to a loopback listener sent over xDS. - A dynamic listener listening at the socket path that the previously defined static cluster is sending metrics to. - A dynamic cluster that will forward traffic received at this listener to the hcp-metrics-collector service. Reasons for having a static cluster pointing at a dynamic listener: - We want to secure the metrics stream using TLS, but the stats sink can only be defined in bootstrap config. With dynamic listeners/clusters we can use the proxy's leaf certificate issued by the Connect CA, which isn't available at bootstrap time. - We want to intelligently route to the HCP collector. Configuring its addreess at bootstrap time limits our flexibility routing-wise. More on this below. Reasons for defining the collector as an upstream in `proxycfg`: - The HCP collector will be deployed as a mesh service. - Certificate management is taken care of, as mentioned above. - Service discovery and routing logic is automatically taken care of, meaning that no code changes are required in the xds package. - Custom routing rules can be added for the collector using discovery chain config entries. Initially the collector is expected to be deployed to each admin partition, but in the future could be deployed centrally in the default partition. These config entries could even be managed by HCP itself.	2 years ago
Eric Haberkorn	57e2493415	allow setting locality on services and nodes (#16581)	2 years ago
Semir Patel	9a5cb20570	Bump submodules from latest 1.15.1 patch release (#16578) ... * Update changelog with Consul patch releases 1.13.7, 1.14.5, 1.15.1 * Bump submodules from latest patch release * Forgot one	2 years ago
Eric Haberkorn	dbaf8bf49c	add agent locality and replicate it across peer streams (#16522)	2 years ago
Eric Haberkorn	5f81662066	Add support for failover policies (#16505)	2 years ago
Andrew Stucki	4b661d1e0c	Add ServiceResolver RequestTimeout for route timeouts to make TerminatingGateway upstream timeouts configurable (#16495) ... * Leverage ServiceResolver ConnectTimeout for route timeouts to make TerminatingGateway upstream timeouts configurable * Regenerate golden files * Add RequestTimeout field * Add changelog entry	2 years ago
skpratt	4653d82ccc	add missing field to oss struct (#16401)	2 years ago
Andrew Stucki	0972697661	[API Gateway] Various fixes for Config Entry fields (#16347) ... * [API Gateway] Various fixes for Config Entry fields * simplify logic per PR review	2 years ago
Andrew Stucki	7f9ec78932	[API Gateway] Validate listener name is not empty (#16340) ... * [API Gateway] Validate listener name is not empty * Update docstrings and test	2 years ago
Dan Stough	82b5b4cc92	fix: revert go mod compat for sdk,api to 1.19 (#16323)	2 years ago
Dan Stough	f1436109ea	[OSS] security: update go to 1.20.1 (#16263) ... * security: update go to 1.20.1	2 years ago
Andrew Stucki	58801cc8aa	Add stricter validation and some normalization code for API Gateway ConfigEntries (#16304) ... * Add stricter validation and some normalization code for API Gateway ConfigEntries	2 years ago
Nathan Coleman	514fb25a6f	Fix infinite recursion in inline-certificate config entry (#16276) ... * Fix infinite recursion on InlineCertificateConfigEntry GetNamespace() + GetMeta() were calling themselves. This change also simplifies by removing nil-checking to match pre-existing config entries Co-Authored-By: Andrew Stucki <3577250+andrewstucki@users.noreply.github.com> * Add tests for inline-certificate * Add alias for private key field on inline-certificate * Use valid certificate + private key for inline-certificate tests --------- Co-authored-by: Andrew Stucki <3577250+andrewstucki@users.noreply.github.com>	2 years ago
Andrew Stucki	9bb0ecfc18	[API Gateway] Add integration test for HTTP routes (#16236) ... * [API Gateway] Add integration test for conflicted TCP listeners * [API Gateway] Update simple test to leverage intentions and multiple listeners * Fix broken unit test * [API Gateway] Add integration test for HTTP routes	2 years ago
skpratt	db2bd404bf	Synthesize anonymous token pre-bootstrap when needed (#16200) ... * add bootstrapping detail for acl errors * error detail improvements * update acl bootstrapping test coverage * update namespace errors * update test coverage * consolidate error message code and update changelog * synthesize anonymous token * Update token language to distinguish Accessor and Secret ID usage (#16044) * remove legacy tokens * remove lingering legacy token references from docs * update language and naming for token secrets and accessor IDs * updates all tokenID references to clarify accessorID * remove token type references and lookup tokens by accessorID index * remove unnecessary constants * replace additional tokenID param names * Add warning info for deprecated -id parameter Co-authored-by: Paul Glass <pglass@hashicorp.com> * Update field comment Co-authored-by: Paul Glass <pglass@hashicorp.com> --------- Co-authored-by: Paul Glass <pglass@hashicorp.com> * revert naming change * add testing * revert naming change --------- Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Andrew Stucki	99cf421e7b	Add some fixes to allow for registering via consul connect envoy -gateway api (#16219) ... * Add some fixes to allow for registering via consul connect envoy -gateway api * Fix infinite recursion --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
skpratt	6f0b226b0d	ACL error improvements: incomplete bootstrapping and non-existent token (#16105) ... * add bootstrapping detail for acl errors * error detail improvements * update acl bootstrapping test coverage * update namespace errors * update test coverage * add changelog * update message for unbootstrapped error * consolidate error message code and update changelog * logout message change	2 years ago
Kyle Havlovitz	898e59b13c	Add the `operator usage instances` command and api endpoint (#16205) ... This endpoint shows total services, connect service instances and billable service instances in the local datacenter or globally. Billable instances = total service instances - connect services - consul server instances.	2 years ago
Andrew Stucki	df03b45bbc	Add additional controller implementations (#16188) ... * Add additional controller implementations * remove additional interface * Fix comparison checks and mark unused contexts * Switch to time.Now().UTC() * Add a pointer helper for shadowing loop variables * Extract anonymous functions for readability * clean up logging * Add Type to the Condition proto * Update some comments and add additional space for readability * Address PR feedback * Fix up dirty checks and change to pointer receiver	2 years ago
cskh	e91bc9c058	feat: envoy extension - http local rate limit (#16196) ... - http local rate limit - Apply rate limit only to local_app - unit test and integ test	2 years ago
skpratt	9199e99e21	Update token language to distinguish Accessor and Secret ID usage (#16044) ... * remove legacy tokens * remove lingering legacy token references from docs * update language and naming for token secrets and accessor IDs * updates all tokenID references to clarify accessorID * remove token type references and lookup tokens by accessorID index * remove unnecessary constants * replace additional tokenID param names * Add warning info for deprecated -id parameter Co-authored-by: Paul Glass <pglass@hashicorp.com> * Update field comment Co-authored-by: Paul Glass <pglass@hashicorp.com> --------- Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Dhia Ayachi	e42ab7e429	Remove empty tags 2 (#16113) ... * Add support for RemoveEmptyTags in API client * Add changelog --------- Co-authored-by: Rémi Lapeyre <remi.lapeyre@lenstra.fr>	2 years ago
skpratt	a010902978	Remove legacy acl policies (#15922) ... * remove legacy tokens * remove legacy acl policies * flatten test policies to *_prefix * address oss feedback re: phrasing and tests	2 years ago
Derek Menteer	2f149d60cc	[OSS] Add Peer field to service-defaults upstream overrides (#15956) ... * Add Peer field to service-defaults upstream overrides. * add api changes, compat mode for service default overrides * Fixes based on testing --------- Co-authored-by: DanStough <dan.stough@hashicorp.com>	2 years ago
skpratt	997c44d1a7	add missing field to oss struct (#16094)	2 years ago
skpratt	ad43846755	Remove legacy acl tokens (#15947) ... * remove legacy tokens * Update test comment Co-authored-by: Paul Glass <pglass@hashicorp.com> * fix imports * update docs for additional CLI changes * add test case for anonymous token * set deprecated api fields to json ignore and fix patch errors * update changelog to breaking-change * fix import * update api docs to remove legacy reference * fix docs nav data --------- Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Thomas Eckert	13da1a5285	Native API Gateway Config Entries (#15897) ... * Stub Config Entries for Consul Native API Gateway (#15644) * Add empty InlineCertificate struct and protobuf * apigateway stubs * Stub HTTPRoute in api pkg * Stub HTTPRoute in structs pkg * Simplify api.APIGatewayConfigEntry to be consistent w/ other entries * Update makeConfigEntry switch, add docstring for HTTPRouteConfigEntry * Add TCPRoute to MakeConfigEntry, return unique Kind * Stub BoundAPIGatewayConfigEntry in agent * Add RaftIndex to APIGatewayConfigEntry stub * Add new config entry kinds to validation allow-list * Add RaftIndex to other added config entry stubs * Update usage metrics assertions to include new cfg entries * Add Meta and acl.EnterpriseMeta to all new ConfigEntry types * Remove unnecessary Services field from added config entry types * Implement GetMeta(), GetEnterpriseMeta() for added config entry types * Add meta field to proto, name consistently w/ existing config entries * Format config_entry.proto * Add initial implementation of CanRead + CanWrite for new config entry types * Add unit tests for decoding of new config entry types * Add unit tests for parsing of new config entry types * Add unit tests for API Gateway config entry ACLs * Return typed PermissionDeniedError on BoundAPIGateway CanWrite * Add unit tests for added config entry ACLs * Add BoundAPIGateway type to AllConfigEntryKinds * Return proper kind from BoundAPIGateway * Add docstrings for new config entry types * Add missing config entry kinds to proto def * Update usagemetrics_oss_test.go * Use utility func for returning PermissionDeniedError * EventPublisher subscriptions for Consul Native API Gateway (#15757) * Create new event topics in subscribe proto * Add tests for PBSubscribe func * Make configs singular, add all configs to PBToStreamSubscribeRequest * Add snapshot methods * Add config_entry_events tests * Add config entry kind to topic for new configs * Add unit tests for snapshot methods * Start adding integration test * Test using the new controller code * Update agent/consul/state/config_entry_events.go * Check value of error * Add controller stubs for API Gateway (#15837) * update initial stub implementation * move files, clean up mutex references * Remove embed, use idiomatic names for constructors * Remove stray file introduced in merge * Add APIGateway validation (#15847) * Add APIGateway validation * Add additional validations * Add cert ref validation * Add protobuf definitions * Fix up field types * Add API structs * Move struct fields around a bit * APIGateway InlineCertificate validation (#15856) * Add APIGateway validation * Add additional validations * Add protobuf definitions * Tabs to spaces * Add API structs * Move struct fields around a bit * Add validation for InlineCertificate * Fix ACL test * APIGateway BoundAPIGateway validation (#15858) * Add APIGateway validation * Add additional validations * Add cert ref validation * Add protobuf definitions * Fix up field types * Add API structs * Move struct fields around a bit * Add validation for BoundAPIGateway * APIGateway TCPRoute validation (#15855) * Add APIGateway validation * Add additional validations * Add cert ref validation * Add protobuf definitions * Fix up field types * Add API structs * Add TCPRoute normalization and validation * Add forgotten Status * Add some more field docs in api package * Fix test * Format imports * Rename snapshot test variable names * Add plumbing for Native API GW Subscriptions (#16003) Co-authored-by: Sarah Alsmiller <sarah.alsmiller@hashicorp.com> Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> Co-authored-by: sarahalsmiller <100602640+sarahalsmiller@users.noreply.github.com> Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>	2 years ago
Paul Glass	f5231b9157	Add new config_file_service_registration token (#15828)	2 years ago
Thomas Eckert	c708e4d5dd	Update the README for the Consul API (#15936)	2 years ago
Eric Haberkorn	8d923c1789	Add the Lua Envoy extension (#15906)	2 years ago
Florian Apolloner	077b0a48a3	Allow Operator Generated bootstrap token (#14437) ... Add support to provide an initial token via the bootstrap HTTP API, similar to hashicorp/nomad#12520	2 years ago