consul

Commit Graph

Author	SHA1	Message	Date
Sophie Gairo	a55c4a1c25	Test: NET-5592 - update Nomad integration testing (#18768 ) NET-5592 - update Nomad integration testing	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756 ) * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
R.B. Boyer	89e6725eee	mesh: create new routes-controller to reconcile xRoute types into a ComputedRoutes resource (#18460 ) This new controller produces an intermediate output (ComputedRoutes) that is meant to summarize all relevant xRoutes and related mesh configuration in an easier-to-use format for downstream use to construct the ProxyStateTemplate. It also applies status updates to the xRoute resource types to indicate that they are themselves semantically valid inputs.	1 year ago
Chris Thain	4724a4e169	Add Envoy golden test for OTEL access logging extension (#18760 )	1 year ago
Michael Zalimeni	5e7afdf9a1	[NET-5574] Update Go version to 1.20.8 (#18742 ) Update Go version to 1.20.8 This resolves several CVEs (see changelog entry).	1 year ago
Poonam Jadhav	264166fcc0	fix: write endpoint errors out gracefully (#18743 )	1 year ago
Ashesh Vidyut	697836b19a	added time stamps (#18757 )	1 year ago
John Murret	62062fd4fd	NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606 ) * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go * NET-5132 - Configure multiport routing for connect proxies in TProxy mode * formatting golden files * reverting golden files and adding changes in manually. build implicit destinations still has some issues. * fixing files that were incorrectly repeating the outbound listener * PR comments * extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName) * removing address level filtering. * adding license to resources_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Ronald	9776c10efb	[NET-5333] Add api to read/list and preview templated policies (#18748 )	1 year ago
Dhia Ayachi	b1688ad856	Run copyright after running deep-copy as part of the Makefile/CI (#18741 ) * execute copyright headers after performing deep-copy generation. * fix copyright install * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * rename steps to match codegen naming * remove copywrite install category --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707 )	1 year ago
Ashesh Vidyut	172e915074	Added logs for debugging (#18740 ) * added logs * added echo * removed pull request	1 year ago
Poonam Jadhav	48ef8b679c	Net-4292/list command (#18649 ) * feat: implement list command * refactor: apply command file parsing	1 year ago
Ashesh Vidyut	7429aba3c9	Increase timeout for integration test windows. (#18737 ) increase timeout	1 year ago
Ashesh Vidyut	bf291f5b8d	Fix windows integrations tests machine size (#18736 ) fix windows integrations tests machine size	1 year ago
David Yu	24d031d1ed	k8s: Update audit-logging docs to include K8s examples (#18721 ) Update audit-logging.mdx	1 year ago
John Murret	3e78b4cf34	Prefix sidecar proxy test files with source and destination. (#18620 ) * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Iryna Shustava	1557e1d6a3	sidecar-proxy controller: Add support for transparent proxy (NET-5069) (#18458 ) This commit adds support for transparent proxy to the sidecar proxy controller. As we do not yet support inferring destinations from intentions, this assumes that all services in the cluster are destinations.	1 year ago
Nathan Coleman	ed79c60e78	NET-5530 Generate deep-copy code (#18730 ) * Generate deep-copy code * Undo license header removal	1 year ago
Ronald	40d7ebc318	[NET-5330] Support templated policies in Binding rules (#18719 ) * [NET-5330] Support templated policies in Binding rules * changelog for templated policy support in binding rules	1 year ago
Semir Patel	576ffdf705	fix: emit consul version metric on a regular interval (#18724 )	1 year ago
Nathan Coleman	e5d26a13cd	NET-5530 Support response header modifiers on http-route config entry (#18646 ) * Add response header filters to http-route config entry definitions * Map response header filters from config entry when constructing route destination * Support response header modifiers at the service level as well * Update protobuf definitions * Update existing unit tests * Add response filters to route consolidation logic * Make existing unit tests more robust * Add missing docstring * Add changelog entry * Add response filter modifiers to existing integration test * Add more robust testing for response header modifiers in the discovery chain * Add more robust testing for request header modifiers in the discovery chain * Modify test to verify that service filter modifiers take precedence over rule filter modifiers	1 year ago
Poonam Jadhav	235988b3bc	Net-2713/resource apply command (#18610 ) * feat: implement apply command * fix: resolve lint issues * refactor: use fixed types * fix: ci lint failures after main rebase	1 year ago
Jeremy Jacobson	876c662e36	[CC-6039] Update builtin policy descriptions (#18705 )	1 year ago
Nick Irvine	3569d702d5	ENT port: test-integ/peering: peer through mesh gateway [NET-4609] (#18605 ) Co-authored-by: Matt Keeler <mjkeeler7@gmail.com>	1 year ago
Iryna Shustava	bbc2763b9f	Instantiate secure resource service client after the grpc server (#18712 )	1 year ago
Melisa Griffin	9adb617695	Adds PassiveHealthCheck Fields to ServiceDefaults and IngressGateway (#18532 ) Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	1 year ago
Ronald	bbef879f85	[NET-5325] ACL templated policies support in tokens and roles (#18708 ) * [NET-5325] ACL templated policies support in tokens and roles - Add API support for creating tokens/roles with templated-policies - Add CLI support for creating tokens/roles with templated-policies * adding changelog	1 year ago
Ashesh Vidyut	993fe9a6a6	Using larger machine for Enterprise (#18713 ) using 4x large for ent	1 year ago
Gerard Nguyen	56d6e54ac7	fix: NET-1521 show latest config in /v1/agent/self (#18681 ) * fix: NET-1521 show latest config in /v1/agent/self	1 year ago
John Maguire	2e7d951086	Added changelog for jwt features (#18709 )	1 year ago
John Maguire	2c244b6f42	[APIGW] NET-5017 JWT Cleanup/Status Conditions (#18700 ) * Fixes issues in setting status * Update golden files for changes to xds generation to not use deprecated methods * Fixed default for validation of JWT for route	1 year ago
R.B. Boyer	acd9b3d1c4	test: update sidecarproxy/builder golden tests to use determinstic golden data (#18703 )	1 year ago
Iryna Shustava	3c70e14713	sidecar-proxy controller: L4 controller with explicit upstreams (NET-3988) (#18352 ) * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * This commit also changes service endpoints to include workload identity. This made the implementation a bit easier as we don't need to look up as many workloads and instead rely on endpoints data.	1 year ago
trujillo-adam	a17f4a0b89	Reformat proxy docs refresh (#18623 ) * first commit; reformat PD conf entry * updated proxies overview page * added Deploy SM proxy usage and removed reg index * moved sidecar proxy usage to main proxy folder * recast sidecar reg page as Deploy sidecar services * fix typos * recast SM reg as conf reference- set the sidebar * add redirects * fix links * add PD conf entry usage to appropro pages * edits to proxy conf ref * fix links on index page * example command to write PD conf entry * updated links to old SM proxy reg page * updated links to sidecar service reg page * tryna fix front matter issues * Apply suggestions from code review Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com> * added paragraph about SM proxies to overivew * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> --------- Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	1 year ago
Nick Irvine	373c7dc144	switch all client nodes in dc2 to dataplane [NET-4299] (#18608 )	1 year ago
Iryna Shustava	4eb2197e82	dataplane: Allow getting bootstrap parameters when using V2 APIs (#18504 ) This PR enables the GetEnvoyBootstrapParams endpoint to construct envoy bootstrap parameters from v2 catalog and mesh resources. * Make bootstrap request and response parameters less specific to services so that we can re-use them for workloads or service instances. * Remove ServiceKind from bootstrap params response. This value was unused previously and is not needed for V2. * Make access logs generation generic so that we can generate them using v1 or v2 resources.	1 year ago
Nick Irvine	80d72e71c1	restore common-topo peering integration tests, but nightly [NET-5476] (#18673 )	1 year ago
Derek Menteer	56917eb4c9	Add support for querying tokens by service name. (#18667 ) Add support for querying tokens by service name The consul-k8s endpoints controller has a workflow where it fetches all tokens. This is not performant for large clusters, where there may be a sizable number of tokens. This commit attempts to alleviate that problem and introduces a new way to query by the token's service name.	1 year ago
Dhia Ayachi	ec507fe4a8	update guide to reflect tenancy and scope (#18687 ) * update guide to reflect tenancy and scope * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * update ACLHooks signature * Update docs/resources/guide.md Co-authored-by: Semir Patel <semir.patel@hashicorp.com> --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
Ashesh Vidyut	60b0485497	Removed nodename and status from consul snapshot save -append-filename command and using leader version in version (#18680 ) * init * fix tests * fix tests lint * fix api call inside dc * updated doc * address comments	1 year ago
Ashesh Vidyut	ac27585dd4	Fix windows Ent runner (#18683 ) * fix windows image for enterprise * added quotesT	1 year ago
Phil Porada	7ea986783d	Add TCP+TLS Healthchecks (#18381 ) * Begin adding TCPUseTLS * More TCP with TLS plumbing * Making forward progress * Keep on adding TCP+TLS support for healthchecks * Removed too many lines * Unit tests for TCP+TLS * Update tlsutil/config.go Co-authored-by: Samantha <hello@entropy.cat> * Working on the tcp+tls unit test * Updated the runtime integration tests * Progress * Revert this file back to HEAD * Remove debugging lines * Implement TLS enabled TCP socket server and make a successful TCP+TLS healthcheck on it * Update docs * Update agent/agent_test.go Co-authored-by: Samantha <hello@entropy.cat> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: Samantha <hello@entropy.cat> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: Samantha <hello@entropy.cat> * Update agent/checks/check.go Co-authored-by: Samantha <hello@entropy.cat> * Address comments * Remove extraneous bracket * Update agent/agent_test.go Co-authored-by: Samantha <hello@entropy.cat> * Update agent/agent_test.go Co-authored-by: Samantha <hello@entropy.cat> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: Samantha <hello@entropy.cat> * Update the mockTLSServer * Remove trailing newline * Address comments * Fix merge problem * Add changelog entry --------- Co-authored-by: Samantha <hello@entropy.cat>	1 year ago
Ashesh Vidyut	0c184042c5	change log for audit log (#18668 ) * change log for audit log * fix file name * breaking change	1 year ago
wangxinyi7	df9d12a56a	Net 2714/xw cli read command (#18462 ) enable `consul resource read` command in cli	1 year ago
Dan Stough	ac867d67e8	test: fix snapshot save w/ append test for ENT (#18656 )	1 year ago
Valeriia Ruban	a2f3d1362a	feat: copy edits for built-in policy alert (#18655 )	1 year ago
Dan Stough	22df51f18f	fix: add telemetry bind socket to proxyConfiguration proto (#18652 )	1 year ago
Valeriia Ruban	99845ebb9d	fix: remove Intention test with latency to make consul-enterprise rep… (#18654 ) fix: remove Intention test with latency to make consul-enterprise repo tests work	1 year ago
Derek Menteer	9915b47898	Add known issue notice for #18636 . (#18650 )	1 year ago

1 2 3 4 5 ...

20471 Commits (a55c4a1c25127e91c7e89488950f4b9bb7122120) All Branches Search

20471 Commits (a55c4a1c25127e91c7e89488950f4b9bb7122120)

All Branches