consul

Commit Graph

Author	SHA1	Message	Date
Sarah Adams	78ad8203a4	Use encoding/json as JSON decoder instead of mapstructure (#6680 ) Fixes #6147	5 years ago
Sarah Christoff	5e1c6e907b	Set MinQuorum variable in Autopilot (#6654 ) * Add MinQuorum to Autopilot	5 years ago
Freddy	60f6ec0c2f	Store check type in catalog (#6561 )	5 years ago
Matt Keeler	4a5ebb57b0	Add support for the Namespace HTTP API in the API Client (#6581 )	5 years ago
Sarah Christoff	5e26971864	Prune Unhealthy Agents (#6571 ) * Add -prune flag to ForceLeave	5 years ago
Freddy	2274f64cab	Add Namespace as an api query/write option (#6551 )	5 years ago
Freddy	fdd10dd8b8	Expose HTTP-based paths through Connect proxy (#6446 ) Fixes: #5396 This PR adds a proxy configuration stanza called expose. These flags register listeners in Connect sidecar proxies to allow requests to specific HTTP paths from outside of the node. This allows services to protect themselves by only listening on the loopback interface, while still accepting traffic from non Connect-enabled services. Under expose there is a boolean checks flag that would automatically expose all registered HTTP and gRPC check paths. This stanza also accepts a paths list to expose individual paths. The primary use case for this functionality would be to expose paths for third parties like Prometheus or the kubelet. Listeners for requests to exposed paths are be configured dynamically at run time. Any time a proxy, or check can be registered, a listener can also be created. In this initial implementation requests to these paths are not authenticated/encrypted.	5 years ago
R.B. Boyer	92fd596d32	api/watch: try to avoid more flakes in this package (#6538 )	5 years ago
R.B. Boyer	af01d397a5	connect: don't colon-hex-encode the AuthorityKeyId and SubjectKeyId fields in connect certs (#6492 ) The fields in the certs are meant to hold the original binary representation of this data, not some ascii-encoded version. The only time we should be colon-hex-encoding fields is for display purposes or marshaling through non-TLS mediums (like RPC).	5 years ago
R.B. Boyer	f74244dde8	api/watch: reduce timing dependence on tests of watch behavior Also for debugging purposes send the stdout/stderr streams from consul processes spawned for API tests to testing.T.Logf	5 years ago
R.B. Boyer	ea6231ce35	api: bump to sdk v0.2.0	5 years ago
R.B. Boyer	fd1c62ee8b	connect: ensure time.Duration fields retain their human readable forms in the API (#6348 ) This applies for both config entries and the compiled discovery chain. Also omit some other config entries fields when empty.	5 years ago
R.B. Boyer	561b2fe606	connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package (#6340 )	5 years ago
R.B. Boyer	ae79cdab1b	connect: introduce ExternalSNI field on service-defaults (#6324 ) Compiling this will set an optional SNI field on each DiscoveryTarget. When set this value should be used for TLS connections to the instances of the target. If not set the default should be used. Setting ExternalSNI will disable mesh gateway use for that target. It also disables several service-resolver features that do not make sense for an external service.	5 years ago
hashicorp-ci	5919c7c184	Merge Consul OSS branch 'master' at commit `8f7586b339`	5 years ago
Matt Keeler	69c7d64701	Add missing LicenseReset API function (#6311 )	5 years ago
Sarah Adams	8ff1f481fe	add flag to allow /operator/keyring requests to only hit local servers (#6279 ) Add parameter local-only to operator keyring list requests to force queries to only hit local servers (no WAN traffic). HTTP API: GET /operator/keyring?local-only=true CLI: consul keyring -list --local-only Sending the local-only flag with any non-GET/list request will result in an error.	5 years ago
Matt Keeler	6a1e0dfed8	Update the v1/agent/service/:service endpoint to output tagged… (#6304 )	5 years ago
Mike Morris	65be58703c	connect: remove managed proxies (#6220 ) * connect: remove managed proxies implementation and all supporting config options and structs * connect: remove deprecated ProxyDestination * command: remove CONNECT_PROXY_TOKEN env var * agent: remove entire proxyprocess proxy manager * test: remove all managed proxy tests * test: remove irrelevant managed proxy note from TestService_ServerTLSConfig * test: update ContentHash to reflect managed proxy removal * test: remove deprecated ProxyDestination test * telemetry: remove managed proxy note * http: remove /v1/agent/connect/proxy endpoint * ci: remove deprecated test exclusion * website: update managed proxies deprecation page to note removal * website: remove managed proxy configuration API docs * website: remove managed proxy note from built-in proxy config * website: add note on removing proxy subdirectory of data_dir	5 years ago
R.B. Boyer	9753c77a79	api: un-deprecate api.DecodeConfigEntry (#6278 ) Add clarifying commentary about when it is not safe to use it. Also add tests.	5 years ago
R.B. Boyer	c395affc93	connect: expose an API endpoint to compile the discovery chain (#6248 ) In addition to exposing compilation over the API cleaned up the structures that would be exchanged to be cleaner and easier to support and understand. Also removed ability to configure the envoy OverprovisioningFactor.	5 years ago
Matt Keeler	5ce6bfa292	Add license management functions to API client (#6268 ) * Add license management functions to API client * Get rid of jsonapi struct tags	5 years ago
R.B. Boyer	ad9e7b6ae9	connect: allow L7 routers to match on http methods (#6164 ) Fixes #6158	5 years ago
R.B. Boyer	85cf2706e6	connect: change router syntax for matching query parameters to resemble the syntax for matching paths and headers for consistency. (#6163 ) This is a breaking change, but only in the context of the beta series.	5 years ago
Alvin Huang	6f1953d96d	Merge branch 'master' into release/1-6	5 years ago
Freddy	59dbd070d7	More flaky test fixes (#6151 ) * Add retry to TestAPI_ClientTxn * Add retry to TestLeader_RegisterMember * Account for empty watch result in ConnectRootsWatch	5 years ago
hashicorp-ci	fa20c7db97	Merge Consul OSS branch 'master' at commit `95dbb7f2f1`	5 years ago
Freddy	d219e31db8	Update retries that weren't using retry.R (#6146 )	5 years ago
Jack Pearkes	338aed32af	Merge branch 'master' into release/1-6	5 years ago
Freddy	97ecc0517c	Fix some retries in api pkg (#6124 )	5 years ago
Freddy	5873c56a03	Flaky test overhaul (#6100 )	5 years ago
Freddy	0b9111714b	Update TestServer creation in sdk/testutil (#6084 ) * Retry the creation of the test server three times. * Reduce the retry timeout for the API wait to 2 seconds, opting to fail faster and start over. * Remove wait for leader from server creation. This wait can be added on a test by test basis now that the function is being exported. * Remove wait for anti-entropy sync. This is built into the existing WaitForSerfCheck func, so that can be used if the anti-entropy wait is needed	5 years ago
Matt Keeler	bdebe62fd0	Fix some tests that I broke when refactoring the ConfigSnapshot (#6051 ) * Fix some tests that I broke when refactoring the ConfigSnapshot * Make sure the MeshGateway config is added to all the right api structs * Fix some more tests	5 years ago
Matt Keeler	8d953f5840	Implement Mesh Gateways This includes both ingress and egress functionality.	5 years ago
R.B. Boyer	2ad516aeaf	do some initial config entry graph validation during writes (#6047 )	5 years ago
R.B. Boyer	38d76c624e	Allow for both snake_case and CamelCase for config entries written with 'consul config write'. (#6044 ) This also has the added benefit of fixing an issue with passing time.Duration fields through config entries.	5 years ago
R.B. Boyer	ceef44bbc9	adding new config entries for L7 discovery chain (unused) (#5987 )	5 years ago
hashicorp-ci	4d185baf55	Merge Consul OSS branch 'master' at commit `88b15d84f9` skip-checks: true	6 years ago
Matt Keeler	6cc1451895	Update some tests to fix ContentHash broken by the tagged service addresses (#5996 )	6 years ago
Aestek	b839f52195	kv: do not trigger watches when setting the same value (#5885 ) If a KVSet is performed but does not update the entry, do not trigger watches for this key. This avoids releasing blocking queries for KV values that did not actually changed.	6 years ago
Matt Keeler	f3d9b999ee	Add tagged addresses for services (#5965 ) This allows addresses to be tagged at the service level similar to what we allow for nodes already. The address translation that can be enabled with the `translate_wan_addrs` config was updated to take these new addresses into account as well.	6 years ago
Pavel Drankov	b3a0b273ed	api: update link to agent caching in comments (#5935 )	6 years ago
R.B. Boyer	b2478036d8	api: go mod tidy	6 years ago
R.B. Boyer	cc9bcccc73	api: bump sdk version to v0.1.1	6 years ago
Paul Banks	0cfb6051ea	Add integration test for central config; fix central config WIP (#5752 ) * Add integration test for central config; fix central config WIP * Add integration test for central config; fix central config WIP * Set proxy protocol correctly and begin adding upstream support * Add upstreams to service config cache key and start new notify watcher if they change. This doesn't update the tests to pass though. * Fix some merging logic get things working manually with a hack (TODO fix properly) * Simplification to not allow enabling sidecars centrally - it makes no sense without upstreams anyway * Test compile again and obvious ones pass. Lots of failures locally not debugged yet but may be flakes. Pushing up to see what CI does * Fix up service manageer and API test failures * Remove the enable command since it no longer makes much sense without being able to turn on sidecar proxies centrally * Remove version.go hack - will make integration test fail until release * Remove unused code from commands and upstream merge * Re-bump version to 1.5.0	6 years ago
Matt Keeler	3145bf5230	Centralized Config CLI (#5731 ) * Add HTTP endpoints for config entry management * Finish implementing decoding in the HTTP Config entry apply endpoint * Add CAS operation to the config entry apply endpoint Also use this for the bootstrapping and move the config entry decoding function into the structs package. * First pass at the API client for the config entries * Fixup some of the ConfigEntry APIs Return a singular response object instead of a list for the ConfigEntry.Get RPC. This gets plumbed through the HTTP API as well. Dont return QueryMeta in the JSON response for the config entry listing HTTP API. Instead just return a list of config entries. * Minor API client fixes * Attempt at some ConfigEntry api client tests These don’t currently work due to weak typing in JSON * Get some of the api client tests passing * Implement reflectwalk magic to correct JSON encoding a ProxyConfigEntry Also added a test for the HTTP endpoint that exposes the problem. However, since the test doesn’t actually do the JSON encode/decode its still failing. * Move MapWalk magic into a binary marshaller instead of JSON. * Add a MapWalk test * Get rid of unused func * Get rid of unused imports * Fixup some tests now that the decoding from msgpack coerces things into json compat types * Stub out most of the central config cli Fully implement the config read command. * Basic config delete command implementation * Implement config write command * Implement config list subcommand Not entirely sure about the output here. Its basically the read output indented with a line specifying the kind/name of each type which is also duplicated in the indented output. * Update command usage * Update some help usage formatting * Add the connect enable helper cli command * Update list command output * Rename the config entry API client methods. * Use renamed apis * Implement config write tests Stub the others with the noTabs tests. * Change list output format Now just simply output 1 line per named config * Add config read tests * Add invalid args write test. * Add config delete tests * Add config list tests * Add connect enable tests * Update some CLI commands to use CAS ops This also modifies the HTTP API for a write op to return a boolean indicating whether the value was written or not. * Fix up the HTTP API CAS tests as I realized they weren’t testing what they should. * Update config entry rpc tests to properly test CAS * Fix up a few more tests * Fix some tests that using ConfigEntries.Apply * Update config_write_test.go * Get rid of unused import	6 years ago
Matt Keeler	4daa1585b0	ACL Token ID Initialization (#5307 )	6 years ago
Kyle Havlovitz	aba54cec55	Add HTTP endpoints for config entry management (#5718 )	6 years ago
Matt Keeler	f67e12eb6f	Enabling "service" watch handler to accept a slice of tags Originally from PR #5347	6 years ago
R.B. Boyer	e47d7eeddb	acl: adding support for kubernetes auth provider login (#5600 ) * auth providers * binding rules * auth provider for kubernetes * login/logout	6 years ago
R.B. Boyer	cc1aa3f973	acl: adding Roles to Tokens (#5514 ) Roles are named and can express the same bundle of permissions that can currently be assigned to a Token (lists of Policies and Service Identities). The difference with a Role is that it not itself a bearer token, but just another entity that can be tied to a Token. This lets an operator potentially curate a set of smaller reusable Policies and compose them together into reusable Roles, rather than always exploding that same list of Policies on any Token that needs similar permissions. This also refactors the acl replication code to be semi-generic to avoid 3x copypasta.	6 years ago
R.B. Boyer	7928305279	making ACLToken.ExpirationTime a *time.Time value instead of time.Time (#5663 ) This is mainly to avoid having the API return "0001-01-01T00:00:00Z" as a value for the ExpirationTime field when it is not set. Unfortunately time.Time doesn't respect the json marshalling "omitempty" directive.	6 years ago
R.B. Boyer	db43fc3a20	acl: ACL Tokens can now be assigned an optional set of service identities (#5390 ) These act like a special cased version of a Policy Template for granting a token the privileges necessary to register a service and its connect proxy, and read upstreams from the catalog.	6 years ago
R.B. Boyer	2144bd7fbd	acl: tokens can be created with an optional expiration time (#5353 )	6 years ago
Matt Keeler	222afeae4c	Move the watch package into the api module (#5664 ) * Move the watch package into the api module It was already just a thin wrapper around the API anyways. The biggest change was to the testing. Instead of using a test agent directly from the agent package it now uses the binary on the PATH just like the other API tests. The other big changes were to fix up the connect based watch tests so that we didn’t need to pull in the connect package (and therefore all of Consul)	6 years ago
Matt Keeler	afa1cc98d1	Implement data filtering of some endpoints (#5579 ) Fixes: #4222 # Data Filtering This PR will implement filtering for the following endpoints: ## Supported HTTP Endpoints - `/agent/checks` - `/agent/services` - `/catalog/nodes` - `/catalog/service/:service` - `/catalog/connect/:service` - `/catalog/node/:node` - `/health/node/:node` - `/health/checks/:service` - `/health/service/:service` - `/health/connect/:service` - `/health/state/:state` - `/internal/ui/nodes` - `/internal/ui/services` More can be added going forward and any endpoint which is used to list some data is a good candidate. ## Usage When using the HTTP API a `filter` query parameter can be used to pass a filter expression to Consul. Filter Expressions take the general form of: ``` <selector> == <value> <selector> != <value> <value> in <selector> <value> not in <selector> <selector> contains <value> <selector> not contains <value> <selector> is empty <selector> is not empty not <other expression> <expression 1> and <expression 2> <expression 1> or <expression 2> ``` Normal boolean logic and precedence is supported. All of the actual filtering and evaluation logic is coming from the [go-bexpr](https://github.com/hashicorp/go-bexpr) library ## Other changes Adding the `Internal.ServiceDump` RPC endpoint. This will allow the UI to filter services better.	6 years ago
Alvin Huang	f45e495e38	Merge pull request #5376 from hashicorp/fix-tests Fix tests in prep for CircleCI Migration	6 years ago
Hans Hasselberg	ac45b17482	fix remaining CI failures after Go 1.12.1 Upgrade (#5576 )	6 years ago
Jeff Mitchell	f1fe406aa8	Update SDK version (#5572 )	6 years ago
Jeff Mitchell	4243c3ae42	Move internal/ to sdk/ (#5568 ) * Move internal/ to sdk/ * Add a readme to the SDK folder	6 years ago
Jeff Mitchell	6327d3fd6f	Update internal dep (#5564 )	6 years ago
Jeff Mitchell	47c390025b	Convert to Go Modules (#5517 ) * First conversion * Use serf 0.8.2 tag and associated updated deps * * Move freeport and testutil into internal/ * Make internal/ its own module * Update imports * Add replace statements so API and normal Consul code are self-referencing for ease of development * Adapt to newer goe/values * Bump to new cleanhttp * Fix ban nonprintable chars test * Update lock bad args test The error message when the duration cannot be parsed changed in Go 1.12 (ae0c435877d3aacb9af5e706c40f9dddde5d3e67). This updates that test. * Update another test as well * Bump travis * Bump circleci * Bump go-discover and godo to get rid of launchpad dep * Bump dockerfile go version * fix tar command * Bump go-cleanhttp	6 years ago
R.B. Boyer	f8bcfcfa46	api: fix panic in 'consul acl set-agent-token' (#5533 ) api: fix panic in 'consul acl set-agent-token' Fixes #5531	6 years ago
R.B. Boyer	f4a3b9d518	fix typos reported by golangci-lint:misspell (#5434 )	6 years ago
Matt Keeler	118adbb123	ACL Token Persistence and Reloading (#5328 ) This PR adds two features which will be useful for operators when ACLs are in use. 1. Tokens set in configuration files are now reloadable. 2. If `acl.enable_token_persistence` is set to `true` in the configuration, tokens set via the `v1/agent/token` endpoint are now persisted to disk and loaded when the agent starts (or during configuration reload) Note that token persistence is opt-in so our users who do not want tokens on the local disk will see no change. Some other secondary changes: * Refactored a bunch of places where the replication token is retrieved from the token store. This token isn't just for replicating ACLs and now it is named accordingly. * Allowed better paths in the `v1/agent/token/` API. Instead of paths like: `v1/agent/token/acl_replication_token` the path can now be just `v1/agent/token/replication`. The old paths remain to be valid. * Added a couple new API functions to set tokens via the new paths. Deprecated the old ones and pointed to the new names. The names are also generally better and don't imply that what you are setting is for ACLs but rather are setting ACL tokens. There is a minor semantic difference there especially for the replication token as again, its no longer used only for ACL token/policy replication. The new functions will detect 404s and fallback to using the older token paths when talking to pre-1.4.3 agents. * Docs updated to reflect the API additions and to show using the new endpoints. * Updated the ACL CLI set-agent-tokens command to use the non-deprecated APIs.	6 years ago
Alvin Huang	e999e404da	add serf check to TestAPI_ACLToken_List	6 years ago
Alvin Huang	aed9d123fa	add serf check to various api/agent tests	6 years ago
Alvin Huang	8124f5889c	add serf check to TestAPI_CatalogNodes	6 years ago
Alvin Huang	9780892ebe	add serf check to TestAPI_ConnectCARoots_empty, TestAPI_ConnectCAConfig_get_set	6 years ago
Alvin Huang	7b4fb32545	add serf check to TestAPI_CoordinateUpdate	6 years ago
Alvin Huang	a2eb3c204d	add serf check to TestAPI_HealthChecks_NodeMetaFilter, TestAPI_HealthConnect	6 years ago
Alvin Huang	7252679232	add serf check to TestAPI_ClientPutGetDelete, TestAPI_ClientWatchGet	6 years ago
Alvin Huang	d93c82e966	add serf check to TestAPI_SemaphoreConflict	6 years ago
Alvin Huang	f98512f1a3	add serf check to TestAPI_Snapshot	6 years ago
Alvin Huang	a5bd6d7c00	add serf check to TestAPI_AgentServices_ManagedConnectProxyDeprecatedUpstreams	6 years ago
Alvin Huang	5f2e709c3f	remove serf check	6 years ago
Alvin Huang	fe7b841e4a	add serf check to TestAPI_SemaphoreConflict	6 years ago
Matt Keeler	acfd87c673	Improve Connect with Prepared Queries (#5291 ) Given a query like: ``` { "Name": "tagged-connect-query", "Service": { "Service": "foo", "Tags": ["tag"], "Connect": true } } ``` And a Consul configuration like: ``` { "services": [ "name": "foo", "port": 8080, "connect": { "sidecar_service": {} }, "tags": ["tag"] ] } ``` If you executed the query it would always turn up with 0 results. This was because the sidecar service was being created without any tags. You could instead make your config look like: ``` { "services": [ "name": "foo", "port": 8080, "connect": { "sidecar_service": { "tags": ["tag"] } }, "tags": ["tag"] ] } ``` However that is a bit redundant for most cases. This PR ensures that the tags and service meta of the parent service get copied to the sidecar service. If there are any tags or service meta set in the sidecar service definition then this copying does not take place. After the changes, the query will now return the expected results. A second change was made to prepared queries in this PR which is to allow filtering on ServiceMeta just like we allow for filtering on NodeMeta.	6 years ago
Matt Keeler	1885cf78f6	Fall back to using old fields when marshaling Co-Authored-By: kyhavlov <kylehav@gmail.com>	6 years ago
Kyle Havlovitz	1a4978fb94	Re-add ReadableDuration types to health check definition This is to fix the backwards-incompatible change made in 1.4.1 by changing these fields to time.Duration.	6 years ago
Hans Hasselberg	174099593a	agent: display messages from serf in cli (#5236 ) * display messages from serf in cli	6 years ago
Kyle Havlovitz	5bdf130767	Merge pull request #4869 from hashicorp/txn-checks Add node/service/check operations to transaction api	6 years ago
Paul Banks	ef9f27cbc8	connect: tame thundering herd of CSRs on CA rotation (#5228 ) * Support rate limiting and concurrency limiting CSR requests on servers; handle CA rotations gracefully with jitter and backoff-on-rate-limit in client * Add CSR rate limiting docs * Fix config naming and add tests for new CA configs	6 years ago
Kyle Havlovitz	21380021af	txn: update existing txn api docs with new operations	6 years ago
Paul Banks	bb7145f27d	agent: add default weights to service in local state to prevent AE churn (#5126 ) * Add default weights when adding a service with no weights to local state to prevent constant AE re-sync. This fix was contributed by @42wim in https://github.com/hashicorp/consul/pull/5096 but was merged against the wrong base. This adds it to master and adds a test to cover the behaviour. * Fix tests that broke due to comparing internal state which now has default weights	6 years ago
Grégoire Seux	4f62a3b528	Implement /v1/agent/health/service/<service name> endpoint (#3551 ) This endpoint aggregates all checks related to <service id> on the agent and return an appropriate http code + the string describing the worst check. This allows to cleanly expose service status to other component, hiding complexity of multiple checks. This is especially useful to use consul to feed a load balancer which would delegate health checking to consul agent. Exposing this endpoint on the agent is necessary to avoid a hit on consul servers and avoid decreasing resiliency (this endpoint will work even if there is no consul leader in the cluster).	6 years ago
Pierre Souchay	f4dc8b42e0	[Travis][UnstableTests] Fixed unstable tests in travis (#5013 ) * [Travis][UnstableTests] Fixed unstable tests in travis as seen in https://travis-ci.org/hashicorp/consul/jobs/460824602 * Fixed unstable tests in https://travis-ci.org/hashicorp/consul/jobs/460857687	6 years ago
Kyle Havlovitz	67bac7a815	api: add support for new txn operations	6 years ago
Kyle Havlovitz	ab58986ac3	txn: add node operations	6 years ago
Kyle Havlovitz	b371ea8783	Add check operations to transaction api	6 years ago
Philipp Gillé	2de7fefedd	Remove wrong space character (#4910 ) There should be no space before a comma	6 years ago
Matt Keeler	db2cf01406	Adds documentation for the new ACL APIs (#4851 ) * Update the ACL API docs * Add a CreateTime to the anon token Also require acl:read permissions at least to perform rule translation. Don’t want someone DoSing the system with an open endpoint that actually does a bit of work. * Fix one place where I was referring to id instead of AccessorID * Add godocs for the API package additions. * Minor updates: removed some extra commas and updated the acl intro paragraph * minor tweaks * Updated the language to be clearer * Updated the language to be clearer for policy page * I was also confused by that! Your updates are much clearer. Co-Authored-By: kaitlincarter-hc <43049322+kaitlincarter-hc@users.noreply.github.com> * Sounds much better. Co-Authored-By: kaitlincarter-hc <43049322+kaitlincarter-hc@users.noreply.github.com> * Updated sidebar layout and deprecated warning	6 years ago
Rémi Lapeyre	f8e56d5365	Add support for multiple checks in Consul Client (#4849 )	6 years ago
Matt Keeler	d238cb181c	New ACL API Tests (#4848 ) * A few API mods and unit tests. * Update the unit tests to verify query/write metadata and to fix the rules endpoint tests. * Make sure the full information for the replication status is in the api packge	6 years ago
Matt Keeler	a02a6be6b9	Implement CLI token cloning & special ID handling (#4827 ) * Implement CLI token cloning & special ID handling * Update a couple CLI commands to take some alternative options. * Document the CLI. * Update the policy list and set-agent-token synopsis	6 years ago
Matt Keeler	18b29c45c4	New ACLs (#4791 ) This PR is almost a complete rewrite of the ACL system within Consul. It brings the features more in line with other HashiCorp products. Obviously there is quite a bit left to do here but most of it is related docs, testing and finishing the last few commands in the CLI. I will update the PR description and check off the todos as I finish them over the next few days/week. Description At a high level this PR is mainly to split ACL tokens from Policies and to split the concepts of Authorization from Identities. A lot of this PR is mostly just to support CRUD operations on ACLTokens and ACLPolicies. These in and of themselves are not particularly interesting. The bigger conceptual changes are in how tokens get resolved, how backwards compatibility is handled and the separation of policy from identity which could lead the way to allowing for alternative identity providers. On the surface and with a new cluster the ACL system will look very similar to that of Nomads. Both have tokens and policies. Both have local tokens. The ACL management APIs for both are very similar. I even ripped off Nomad's ACL bootstrap resetting procedure. There are a few key differences though. Nomad requires token and policy replication where Consul only requires policy replication with token replication being opt-in. In Consul local tokens only work with token replication being enabled though. All policies in Nomad are globally applicable. In Consul all policies are stored and replicated globally but can be scoped to a subset of the datacenters. This allows for more granular access management. Unlike Nomad, Consul has legacy baggage in the form of the original ACL system. The ramifications of this are: A server running the new system must still support other clients using the legacy system. A client running the new system must be able to use the legacy RPCs when the servers in its datacenter are running the legacy system. The primary ACL DC's servers running in legacy mode needs to be a gate that keeps everything else in the entire multi-DC cluster running in legacy mode. So not only does this PR implement the new ACL system but has a legacy mode built in for when the cluster isn't ready for new ACLs. Also detecting that new ACLs can be used is automatic and requires no configuration on the part of administrators. This process is detailed more in the "Transitioning from Legacy to New ACL Mode" section below.	6 years ago
Jack Pearkes	8c684db488	New command: consul debug (#4754 ) * agent/debug: add package for debugging, host info * api: add v1/agent/host endpoint * agent: add v1/agent/host endpoint * command/debug: implementation of static capture * command/debug: tests and only configured targets * agent/debug: add basic test for host metrics * command/debug: add methods for dynamic data capture * api: add debug/pprof endpoints * command/debug: add pprof * command/debug: timing, wg, logs to disk * vendor: add gopsutil/disk * command/debug: add a usage section * website: add docs for consul debug * agent/host: require operator:read * api/host: improve docs and no retry timing * command/debug: fail on extra arguments * command/debug: fixup file permissions to 0644 * command/debug: remove server flags * command/debug: improve clarity of usage section * api/debug: add Trace for profiling, fix profile * command/debug: capture profile and trace at the same time * command/debug: add index document * command/debug: use "clusters" in place of members * command/debug: remove address in output * command/debug: improve comment on metrics sleep * command/debug: clarify usage * agent: always register pprof handlers and protect This will allow us to avoid a restart of a target agent for profiling by always registering the pprof handlers. Given this is a potentially sensitive path, it is protected with an operator:read ACL and enable debug being set to true on the target agent. enable_debug still requires a restart. If ACLs are disabled, enable_debug is sufficient. * command/debug: use trace.out instead of .prof More in line with golang docs. * agent: fix comment wording * agent: wrap table driven tests in t.run()	6 years ago
Rebecca Zanzig	34e5516834	Support multiple tags for health and catalog http api endpoints (#4717 ) * Support multiple tags for health and catalog api endpoints Fixes #1781. Adds a `ServiceTags` field to the ServiceSpecificRequest to support multiple tags, updates the filter logic in the catalog store, and propagates these change through to the health and catalog endpoints. Note: Leaves `ServiceTag` in the struct, since it is being used as part of the DNS lookup, which in turn uses the health check. * Update the api package to support multiple tags Includes additional tests. * Update new tests to use the `require` library * Update HealthConnect check after a bad merge	6 years ago
Pierre Souchay	251156eb68	Added SOA configuration for DNS settings. (#4714 ) This will allow to fine TUNE SOA settings sent by Consul in DNS responses, for instance to be able to control negative ttl. Will fix: https://github.com/hashicorp/consul/issues/4713 # Example Override all settings: * min_ttl: 0 => 60s * retry: 600 (10m) => 300s (5 minutes), * expire: 86400 (24h) => 43200 (12h) * refresh: 3600 (1h) => 1800 (30 minutes) ``` consul agent -dev -hcl 'dns_config={soa={min_ttl=60,retry=300,expire=43200,refresh=1800}}' ``` Result: ``` dig +multiline @localhost -p 8600 service.consul ; <<>> DiG 9.12.1 <<>> +multiline @localhost -p 8600 service.consul ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36557 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;service.consul. IN A ;; AUTHORITY SECTION: consul. 0 IN SOA ns.consul. hostmaster.consul. ( 1537959133 ; serial 1800 ; refresh (30 minutes) 300 ; retry (5 minutes) 43200 ; expire (12 hours) 60 ; minimum (1 minute) ) ;; Query time: 4 msec ;; SERVER: 127.0.0.1#8600(127.0.0.1) ;; WHEN: Wed Sep 26 12:52:13 CEST 2018 ;; MSG SIZE rcvd: 93 ```	6 years ago
R.B. Boyer	c310451b2b	cli: avoid passing envoy bootstrap configuration as arguments (#4747 ) Play a trick with CLOEXEC to pass the envoy bootstrap configuration as an open file descriptor to the exec'd envoy process. The file only briefly touches disk before being unlinked. We convince envoy to read from this open file descriptor by using the /dev/fd/$FDNUMBER mechanism to read the open file descriptor as a file. Because the filename no longer has an extension envoy's sniffing logic falls back on JSON instead of YAML, so the bootstrap configuration must be generated as JSON instead.	6 years ago
Paul Banks	161482d2cd	Fix up tests broken by master merge; add proxy tests to services command (and fix it!); actually run the proxycfg.Manager	6 years ago
Paul Banks	dca1303d05	Connect Envoy Command (#4735 ) * Plumb xDS server and proxyxfg into the agent startup * Add `consul connect envoy` command to allow running Envoy as a connect sidecar. * Add test for help tabs; typos and style fixups from review	6 years ago
Paul Banks	e812f5516a	Add -sidecar-for and new /agent/service/:service_id endpoint (#4691 ) - A new endpoint `/v1/agent/service/:service_id` which is a generic way to look up the service for a single instance. The primary value here is that it: - supports hash-based blocking and so; - replaces `/agent/connect/proxy/:proxy_id` as the mechanism the built-in proxy uses to read its config. - It's not proxy specific and so works for any service. - It has a temporary shim to call through to the existing endpoint to preserve current managed proxy config defaulting behaviour until that is removed entirely (tested). - The built-in proxy now uses the new endpoint exclusively for it's config - The built-in proxy now has a `-sidecar-for` flag that allows the service ID of the _target_ service to be specified, on the condition that there is exactly one "sidecar" proxy (that is one that has `Proxy.DestinationServiceID` set) for the service registered. - Several fixes for edge cases for SidecarService - A fix for `Alias` checks - when running locally they didn't update their state until some external thing updated the target. If the target service has no checks registered as below, then the alias never made it past critical.	6 years ago
Paul Banks	1e7eace066	Add SidecarService Syntax sugar to Service Definition (#4686 ) * Added new Config for SidecarService in ServiceDefinitions. * WIP: all the code needed for SidecarService is written... none of it is tested other than config :). Need API updates too. * Test coverage for the new sidecarServiceFromNodeService method. * Test API registratrion with SidecarService * Recursive Key Translation 🤦 * Add tests for nested sidecar defintion arrays to ensure they are translated correctly * Use dedicated internal state rather than Service Meta for tracking sidecars for deregistration. Add tests for deregistration. * API struct for agent register. No other endpoint should be affected yet. * Additional test cases to cover updates to API registrations	6 years ago
Paul Banks	b83bbf248c	Add Proxy Upstreams to Service Definition (#4639 ) * Refactor Service Definition ProxyDestination. This includes: - Refactoring all internal structs used - Updated tests for both deprecated and new input for: - Agent Services endpoint response - Agent Service endpoint response - Agent Register endpoint - Unmanaged deprecated field - Unmanaged new fields - Managed deprecated upstreams - Managed new - Catalog Register - Unmanaged deprecated field - Unmanaged new fields - Managed deprecated upstreams - Managed new - Catalog Services endpoint response - Catalog Node endpoint response - Catalog Service endpoint response - Updated API tests for all of the above too (both deprecated and new forms of register) TODO: - config package changes for on-disk service definitions - proxy config endpoint - built-in proxy support for new fields * Agent proxy config endpoint updated with upstreams * Config file changes for upstreams. * Add upstream opaque config and update all tests to ensure it works everywhere. * Built in proxy working with new Upstreams config * Command fixes and deprecations * Fix key translation, upstream type defaults and a spate of other subtele bugs found with ned to end test scripts... TODO: tests still failing on one case that needs a fix. I think it's key translation for upstreams nested in Managed proxy struct. * Fix translated keys in API registration. ≈ * Fixes from docs - omit some empty undocumented fields in API - Bring back ServiceProxyDestination in Catalog responses to not break backwards compat - this was removed assuming it was only used internally. * Documentation updates for Upstreams in service definition * Fixes for tests broken by many refactors. * Enable travis on f-connect branch in this branch too. * Add consistent Deprecation comments to ProxyDestination uses * Update version number on deprecation notices, and correct upstream datacenter field with explanation in docs	6 years ago
Paul Banks	88388d760d	Support Agent Caching for Service Discovery Results (#4541 ) * Add cache types for catalog/services and health/services and basic test that caching works * Support non-blocking cache types with Cache-Control semantics. * Update API docs to include caching info for every endpoint. * Comment updates per PR feedback. * Add note on caching to the 10,000 foot view on the architecture page to make the new data path more clear. * Document prepared query staleness quirk and force all background requests to AllowStale so we can spread service discovery load across servers.	6 years ago
Freddy	524192c919	Improve resilience of api pkg tests (#4676 ) * Add function to wait for serfHealth in api tests * Disable connect when creating semaphore test clients * Wait for serfHealth when creating sessions in their tests * Add helper functions to create lock/semaphore sessions without checks * Log passing tests to prevent timeout in Travis due to lack of output	6 years ago
Pierre Souchay	22500f242e	Fix unstable tests in agent, api, and command/watch	6 years ago
Pierre Souchay	eddcf228ea	Implementation of Weights Data structures (#4468 ) * Implementation of Weights Data structures Adding this datastructure will allow us to resolve the issues #1088 and #4198 This new structure defaults to values: ``` { Passing: 1, Warning: 0 } ``` Which means, use weight of 0 for a Service in Warning State while use Weight 1 for a Healthy Service. Thus it remains compatible with previous Consul versions. * Implemented weights for DNS SRV Records * DNS properly support agents with weight support while server does not (backwards compatibility) * Use Warning value of Weights of 1 by default When using DNS interface with only_passing = false, all nodes with non-Critical healthcheck used to have a weight value of 1. While having weight.Warning = 0 as default value, this is probably a bad idea as it breaks ascending compatibility. Thus, we put a default value of 1 to be consistent with existing behaviour. * Added documentation for new weight field in service description * Better documentation about weights as suggested by @banks * Return weight = 1 for unknown Check states as suggested by @banks * Fixed typo (of -> or) in error message as requested by @mkeeler * Fixed unstable unit test TestRetryJoin * Fixed unstable tests * Fixed wrong Fatalf format in `testrpc/wait.go` * Added notes regarding DNS SRV lookup limitations regarding number of instances * Documentation fixes and clarification regarding SRV records with weights as requested by @banks * Rephrase docs	6 years ago
Freddy	4c5758d891	Remove operator_area note from godoc overview (#4603 )	6 years ago
Siva Prasad	771e0bafd2	Addresses the flakiness of CatalogNodes (#4530 )	6 years ago
Pierre Souchay	cec5d72396	BUGFIX: Unit test relying on WaitForLeader() did not work due to wrong test (#4472 ) - Improve resilience of testrpc.WaitForLeader() - Add additionall retry to CI - Increase "go test" timeout to 8m - Add wait for cluster leader to several tests in the agent package - Add retry to some tests in the api and command packages	6 years ago
Geoffrey Grosenbach	827fbac3ab	Copy-and-paste Go client example (#4448 ) * Copy-and-paste Go client example Includes Go source that runs without modification, as well as simple instructions for compiling, running, and viewing the output in the Consul UI. * Remove unnecessary flags from development server example This is a bare minimum Go example needed to store keys and values in Consul. The `-ui` and `-server` flags aren't needed when running with `-dev`.	6 years ago
Kyle Havlovitz	ed87949385	Merge pull request #4400 from hashicorp/leaf-cert-ttl Add configurable leaf cert TTL to Connect CA	6 years ago
Paul Banks	8cbeb29e73	Fixes #4421 : General solution to stop blocking queries with index 0 (#4437 ) * Fix theoretical cache collision bug if/when we use more cache types with same result type * Generalized fix for blocking query handling when state store methods return zero index * Refactor test retry to only affect CI * Undo make file merge * Add hint to error message returned to end-user requests if Connect is not enabled when they try to request cert * Explicit error for Roots endpoint if connect is disabled * Fix tests that were asserting old behaviour	6 years ago
Kyle Havlovitz	d6ca015a42	connect/ca: add configurable leaf cert TTL	6 years ago
Matt Keeler	7572ca0f37	Merge pull request #4374 from hashicorp/feature/proxy-env-vars Setup managed proxy environment with API client env vars	6 years ago
Matt Keeler	7dfd2ab316	Add some tests for GenerateEnv	6 years ago
Matt Keeler	c54b43bef3	PR Updates Proxy now doesn’t need to know anything about the api as we pass env vars to it instead of the api config.	6 years ago
Matt Keeler	3b6eef8ec6	Pass around an API Config object and convert to env vars for the managed proxy	6 years ago
Hamish	9043966efd	Fix lock and semaphore timeouts	6 years ago
Mitchell Hashimoto	1c3e9af316	agent: 400 error on invalid UUID format, api handles errors properly	7 years ago
Kyle Havlovitz	162daca4d7	revert go changes to hide rotation config	7 years ago
Kyle Havlovitz	c20bbf8760	connect/ca: hide the RotationPeriod config field since it isn't used yet	7 years ago
Kyle Havlovitz	bc997688e3	connect/ca: update Consul provider to use new cross-sign CSR method	7 years ago
Paul Banks	b5f24a21cb	Fix test broken by final telemetry PR change!	7 years ago
Paul Banks	597e55e8e2	Misc test fixes	7 years ago
Paul Banks	96c416012e	Misc rebase and test fixes	7 years ago
Paul Banks	43b48bc06b	Get agent cache tests passing without global hit count (which is racy). Few other fixes in here just to get a clean run locally - they are all also fixed in other PRs but shouldn't conflict. This should be robust to timing between goroutines now.	7 years ago
Paul Banks	05a8097c5d	Fix misc test failures (some from other PRs)	7 years ago
Kyle Havlovitz	82a4b3c13f	connect: fix two CA tests that were broken in a previous PR (#60 )	7 years ago
Paul Banks	0824d1df5f	Misc comment cleanups	7 years ago
Mitchell Hashimoto	71216631d7	api: update intention struct for precedence	7 years ago
Mitchell Hashimoto	77a8003475	api: change Connect to a query option	7 years ago
Mitchell Hashimoto	b55f0641e6	api: support ExecuteConnect	7 years ago
Mitchell Hashimoto	297e4f272e	api: support native connect	7 years ago
Paul Banks	df2cb30b01	Make tests pass and clean proxy persistence. No detached child changes yet. This is a good state for persistence stuff to re-start the detached child work that got mixed up last time.	7 years ago
Paul Banks	cdc7cfaa36	Abandon daemonize for simpler solution (preserving history): Reverts: - bdb274852ae469c89092d6050697c0ff97178465 - 2c689179c4f61c11f0016214c0fc127a0b813bfe - d62e25c4a7ab753914b6baccd66f88ffd10949a3 - c727ffbcc98e3e0bf41e1a7bdd40169bd2d22191 - 31b4d18933fd0acbe157e28d03ad59c2abf9a1fb - 85c3f8df3eabc00f490cd392213c3b928a85aa44	7 years ago
Paul Banks	ba0fb58a72	Make daemoinze an option on test binary without hacks. Misc fixes for racey or broken tests. Still failing on several though.	7 years ago
Kyle Havlovitz	74f225fcd2	Add client api support for CA config endpoints	7 years ago
Mitchell Hashimoto	3a6a750972	api: IntentionUpdate API	7 years ago
Mitchell Hashimoto	f27711a319	api: IntentionDelete + tests	7 years ago
Mitchell Hashimoto	272211e171	command/intention/get: the get command without tests	7 years ago
Mitchell Hashimoto	988d7d984a	command/intention/finder: package for finding based on src/dst	7 years ago
Mitchell Hashimoto	961e9c1eaf	command/intention/create	7 years ago
Mitchell Hashimoto	a5ecdc5798	api: IntentionCheck	7 years ago
Paul Banks	7c7c858a9a	More test cleanup	7 years ago
Paul Banks	4aeab3897c	Fixed many tests after rebase. Some still failing and seem unrelated to any connect changes.	7 years ago
Mitchell Hashimoto	aaa2431350	agent: change connect command paths to be slices, not strings This matches other executable configuration and allows us to cleanly separate executable from arguments without trying to emulate shell parsing.	7 years ago
Paul Banks	e0e12e165b	TLS watching integrated into Service with some basic tests. There are also a lot of small bug fixes found when testing lots of things end-to-end for the first time and some cleanup now it's integrated with real CA code.	7 years ago
Paul Banks	cd88b2a351	Basic `watch` support for connect proxy config and certificate endpoints. - Includes some bug fixes for previous `api` work and `agent` that weren't tested - Needed somewhat pervasive changes to support hash based blocking - some TODOs left in our watch toolchain that will explicitly fail on hash-based watches. - Integration into `connect` is partially done here but still WIP	7 years ago
Paul Banks	36dbd878c9	Adds `api` client code and tests for new Proxy Config endpoint, registering with proxy and seeing proxy config in /agent/services list.	7 years ago
Paul Banks	88541bba17	Add tests all the way up through the endpoints to ensure duplicate src/destination is supported and so ultimately deny/allow nesting works. Also adds a sanity check test for `api.Agent().ConnectAuthorize()` and a fix for a trivial bug in it.	7 years ago
Mitchell Hashimoto	97f5414d94	api: rename Authorize field to ClientCertURI	7 years ago
Mitchell Hashimoto	9638466b88	api: fix up some comments and rename IssuedCert to LeafCert	7 years ago
Mitchell Hashimoto	4689d8373a	api: IntentionMatch	7 years ago
Mitchell Hashimoto	663a12d96b	api: starting intention endpoints, reorganize files slightly	7 years ago
Mitchell Hashimoto	263e2c7cf7	api: endpoints for working with CA roots, agent authorize, etc.	7 years ago
Paul Banks	125555e1aa	require -> assert until rebase	7 years ago
Paul Banks	9309422fd9	Add Connect agent, catalog and health endpoints to api Client	7 years ago
Kyle Havlovitz	b73323aa42	Remove the script field from checks in favor of args	7 years ago
Pierre Souchay	c152cb7bdf	Added Missing Service Meta synchronization and field	7 years ago
Paul Banks	0d8993e338	Allow ignoring checks by ID when defining a PreparedQuery. Fixes #3727 .	7 years ago
Preetha Appan	c7581d68c6	Renames agent API layer for service metadata to "meta" for consistency	7 years ago
Preetha	daa61c5803	Merge pull request #3881 from pierresouchay/service_metadata Feature Request: Support key-value attributes for services	7 years ago
Josh Soref	94835a2715	Spelling (#3958 ) * spelling: another * spelling: autopilot * spelling: beginning * spelling: circonus * spelling: default * spelling: definition * spelling: distance * spelling: encountered * spelling: enterprise * spelling: expands * spelling: exits * spelling: formatting * spelling: health * spelling: hierarchy * spelling: imposed * spelling: independence * spelling: inspect * spelling: last * spelling: latest * spelling: client * spelling: message * spelling: minimum * spelling: notify * spelling: nonexistent * spelling: operator * spelling: payload * spelling: preceded * spelling: prepared * spelling: programmatically * spelling: required * spelling: reconcile * spelling: responses * spelling: request * spelling: response * spelling: results * spelling: retrieve * spelling: service * spelling: significantly * spelling: specifies * spelling: supported * spelling: synchronization * spelling: synchronous * spelling: themselves * spelling: unexpected * spelling: validations * spelling: value	7 years ago
Anubhav Mishra	0813175340	fix typo	7 years ago
Pierre Souchay	b259b1609c	Merge remote-tracking branch 'origin/master' into service_metadata	7 years ago
Kyle Havlovitz	c3e94970a0	Add gRPC fields to client api and agent check endpoint docs	7 years ago
Pierre Souchay	80dde5465b	Added support for Service Metadata	7 years ago
Veselkov Konstantin	7de57ba4de	remove golint warnings	7 years ago
James Hartig	ac225b2e7d	Added CheckID and Name to AgentServiceCheck struct	7 years ago
James Phillips	53a881becc	Tightens up the API test verification.	7 years ago
James Phillips	ca3f9024ac	Works around mapstructure behavior to enable sessions with no checks. Fixes #3732	7 years ago
James Phillips	3177c2b450	Opens up the timing on the metrics test so it's less flaky.	7 years ago
James Phillips	93f68555d0	Adds enable_agent_tls_for_checks configuration option which allows (#3661 ) HTTP health checks for services requiring 2-way TLS to be checked using the agent's credentials.	7 years ago
James Phillips	4a2cafe525	Adds HTTP/2 support to Consul's HTTPS server. (#3657 ) * Refactors the HTTP listen path to create servers in the same spot. * Adds HTTP/2 support to Consul's HTTPS server. * Vendors Go HTTP/2 library and associated deps.	7 years ago
James Phillips	172d5c0c40	Fetches metrics in the retry loop so there's some hope. Fixes #3656	7 years ago
Kyle Havlovitz	c9c083d843	Update AgentCheck struct in api	7 years ago
Kyle Havlovitz	d3dd2b1402	Move check definition to a sub-struct	7 years ago
Kyle Havlovitz	dbab3cd5f6	Merge branch 'master' into esm-changes	7 years ago
Kyle Havlovitz	021b2849c5	Remove redundant lines from coordinate test	7 years ago
Kyle Havlovitz	b0536a96cc	Fill out the tests around coordinate/node functionality	7 years ago
Kyle Havlovitz	a1d14019dd	Add tests around coordinate update endpoint	7 years ago
Kyle Havlovitz	2392545adc	Merge branch 'coordinate-node-endpoint' of github.com:hashicorp/consul into esm-changes	7 years ago
Kyle Havlovitz	5589eadcf5	Added Coordinate.Node rpc endpoint and client api method	7 years ago
Kyle Havlovitz	ce4e8c46fa	Add deregister critical service field and refactor duration parsing	7 years ago
James Phillips	21f38bff6f	Adds retry to API metrics test (flaky test).	7 years ago
Kyle Havlovitz	291455f475	Added coordinate update http endpoint	7 years ago
Kyle Havlovitz	d56936e27a	Added remaining HTTP health check fields to structs	7 years ago
Kyle Havlovitz	a7c42a6c2a	Expose SkipNodeUpdate field and some health check info in the http api	7 years ago
Ryan Slade	dcb392df46	Simplify string(buf.Bytes()) to buf.String() (#3590 )	7 years ago
James Phillips	53f67c3993	Fixes API client for ScriptArgs and updates documentation. (#3589 ) * Updates the API client to support the current `ScriptArgs` parameter for checks. * Updates docs for checks to explain the `ScriptArgs` parameter issue. * Adds mappings for "args" and "script-args" to give th API parity with config. * Adds checks on return codes. * Removes debug logging that shows empty when args are used.	7 years ago
Ryan Slade	85e4aea9d1	Replace time.Now().Sub(x) with time.Since(x)	7 years ago
James Phillips	575d70aaa7	Cleans up some drift between the OSS and Enterprise trees.	7 years ago
James Bardin	fea32fb7d7	retry locks on network errors (#3553 ) * retry locks on network errors When communicating with a local agent and watching a lock, a dropped connection between the agent and server will show up as a server error and immediately be retried. However if the client is connected to a remote server, a dropped connection immediately aborts the lock. * Updates comment about it being unsafe for writes.	7 years ago
Artiom Diomin	2e229617ce	Fix example code formatting in godoc	7 years ago
Frank Schröder	ce887a0c45	Provide stable config for agent/self (#3532 ) * config: provide stable config for /v1/agent/self (#3530) This patch adds a stable subset of the previous Config struct to the agent/self response. The actual runtime configuration is moved into DebugConfig and will be documented to change. Fixes #3530 * config: fix tests * doc: update api documentation for /v1/agent/self	7 years ago
Frank Schröder	21118cafeb	Recursive sanitize (#3505 ) * vendor: add github.com/sergi/go-diff/diffmatchpatch for diff'ing test output * config: refactor Sanitize to recursively clean runtime config and format complex fields * Removes an extra int cast. * Adds a top-level check test case for sanitization.	7 years ago
Preetha Appan	3c4a108769	Move Raft protocol version for list peers end point to server side, fix unit tests. This fixes #3449	7 years ago
Preetha Appan	00840929ea	Fix import order	7 years ago
preetapan	73951d8319	Merge pull request #3494 from hashicorp/enforce_json_extension Enforce json or hcl extension to Consul config files, updated unit tests	7 years ago
James Phillips	45646ac3f4	Bumps default Raft protocol to version 3. (#3477 ) * Changes default Raft protocol to 3. * Changes numPeers() to report only voters. This should have been there before, but it's more obvious that this is incorrect now that we default the Raft protocol to 3, which puts new servers in a read-only state while Autopilot waits for them to become healthy. * Fixes TestLeader_RollRaftServer. * Fixes TestOperator_RaftRemovePeerByAddress. * Fixes TestServer_. Relaxed the check for a given number of voter peers and instead do a thorough check that all servers see each other in their Raft configurations. Fixes TestACL_. These now just check for Raft replication to be set up, and don't care about the number of voter peers. Fixes TestOperator_Raft_ListPeers. * Fixes TestAutopilot_CleanupDeadServerPeriodic. * Fixes TestCatalog_ListNodes_ConsistentRead_Fail. * Fixes TestLeader_ChangeServerID and adjusts the conn pool to throw away sockets when it sees io.EOF. * Changes version to 1.0.0 in the options doc. * Makes metrics test more deterministic with autopilot metrics possible.	7 years ago
Preetha Appan	a4331a480c	Fix one more unit test that created a config file	7 years ago
Frank Schröder	12216583a1	New config parser, HCL support, multiple bind addrs (#3480 ) * new config parser for agent This patch implements a new config parser for the consul agent which makes the following changes to the previous implementation: * add HCL support * all configuration fragments in tests and for default config are expressed as HCL fragments * HCL fragments can be provided on the command line so that they can eventually replace the command line flags. * HCL/JSON fragments are parsed into a temporary Config structure which can be merged using reflection (all values are pointers). The existing merge logic of overwrite for values and append for slices has been preserved. * A single builder process generates a typed runtime configuration for the agent. The new implementation is more strict and fails in the builder process if no valid runtime configuration can be generated. Therefore, additional validations in other parts of the code should be removed. The builder also pre-computes all required network addresses so that no address/port magic should be required where the configuration is used and should therefore be removed. * Upgrade github.com/hashicorp/hcl to support int64 * improve error messages * fix directory permission test * Fix rtt test * Fix ForceLeave test * Skip performance test for now until we know what to do * Update github.com/hashicorp/memberlist to update log prefix * Make memberlist use the default logger * improve config error handling * do not fail on non-existing data-dir * experiment with non-uniform timeouts to get a handle on stalled leader elections * Run tests for packages separately to eliminate the spurious port conflicts * refactor private address detection and unify approach for ipv4 and ipv6. Fixes #2825 * do not allow unix sockets for DNS * improve bind and advertise addr error handling * go through builder using test coverage * minimal update to the docs * more coverage tests fixed * more tests * fix makefile * cleanup * fix port conflicts with external port server 'porter' * stop test server on error * do not run api test that change global ENV concurrently with the other tests * Run remaining api tests concurrently * no need for retry with the port number service * monkey patch race condition in go-sockaddr until we understand why that fails * monkey patch hcl decoder race condidtion until we understand why that fails * monkey patch spurious errors in strings.EqualFold from here * add test for hcl decoder race condition. Run with go test -parallel 128 * Increase timeout again * cleanup * don't log port allocations by default * use base command arg parsing to format help output properly * handle -dc deprecation case in Build * switch autopilot.max_trailing_logs to int * remove duplicate test case * remove unused methods * remove comments about flag/config value inconsistencies * switch got and want around since the error message was misleading. * Removes a stray debug log. * Removes a stray newline in imports. * Fixes TestACL_Version8. * Runs go fmt. * Adds a default case for unknown address types. * Reoders and reformats some imports. * Adds some comments and fixes typos. * Reorders imports. * add unix socket support for dns later * drop all deprecated flags and arguments * fix wrong field name * remove stray node-id file * drop unnecessary patch section in test * drop duplicate test * add test for LeaveOnTerm and SkipLeaveOnInt in client mode * drop "bla" and add clarifying comment for the test * split up tests to support enterprise/non-enterprise tests * drop raft multiplier and derive values during build phase * sanitize runtime config reflectively and add test * detect invalid config fields * fix tests with invalid config fields * use different values for wan sanitiziation test * drop recursor in favor of recursors * allow dns_config.udp_answer_limit to be zero * make sure tests run on machines with multiple ips * Fix failing tests in a few more places by providing a bind address in the test * Gets rid of skipped TestAgent_CheckPerformanceSettings and adds case for builder. * Add porter to server_test.go to make tests there less flaky * go fmt	7 years ago
James Phillips	00605c0214	Shows the segment name in the keyring API and command output.	7 years ago
James Phillips	1a117ba0a8	Makes the all segments query explict, and the default for `consul members`.	7 years ago
Kyle Havlovitz	20296d4a89	Change segment list endpoint in docs/client api	7 years ago
Kyle Havlovitz	62102a537e	Organize segments for a cleaner split between enterprise and OSS	7 years ago
Kyle Havlovitz	21513b0393	Update coord display in ui to account for segments	7 years ago
Kyle Havlovitz	2ada0439d4	Add rpc_listener option to segment config	7 years ago
James Phillips	b1a15e0c3d	Adds open source side of network segments (feature is Enterprise-only).	7 years ago
Illirgway	e0cc1ce679	Fix bug with unused (replaced with "") CONSUL_HTTP_AUTH in some places example: https://github.com/hashicorp/consul/blob/master/watch/plan.go#L26 conf := consulapi.DefaultConfig() conf.Address = address conf.Datacenter = p.Datacenter conf.Token = p.Token # <-- replace Token from DefaultConfig/CONSUL_HTTP_AUTH with "" client, err := consulapi.NewClient(conf) how to reproduce bug: 0. consul -> localhost:8500 with more than 0 service checks 1. deny all for anonymous token 2. create appropriate acl <token> for watch checks (agent:read + node:read,service:read) 3. bash: CONSUL_HTTP_AUTH=<token> consul watch -http-addr=localhost:8500 -type=checks # --> return [] consul watch -http-addr=localhost:8500 -type=checks -token=<token> # -> return { .... right json result .... }	7 years ago
James Phillips	6ccf724c0c	Adds a guard to make sure that empty log lines don't close consul monitor. Fixes #3253.	7 years ago
Kyle Havlovitz	5b998cacb1	Update api structs for metrics endpoint	7 years ago
Kyle Havlovitz	d5634fe2a8	Add support for labels/filters from go-metrics	7 years ago
James Phillips	4bee2e49f5	Adds secure introduction for the ACL replication token. (#3357 ) Adds secure introduction for the ACL replication token, as well as a separate enable config for ACL replication.	7 years ago
James Phillips	c0a5ad7903	Adds a new /v1/acl/bootstrap API (#3349 )	7 years ago
James Phillips	496b0bcf07	Adds support for agent-side ACL token management via API instead of config files. (#3324 ) * Adds token store and removes all runtime use of config for ACL tokens. * Adds a new API for changing agent tokens on the fly.	7 years ago
Kyle Havlovitz	19eae3d14b	Add UpgradeVersionTag to autopilot config	7 years ago
James Phillips	1791d99a10	Adds new config to make script checks opt-in, updates documentation. (#3284 )	7 years ago
James Phillips	8d0a048408	Expands and rework context support in the API client. (#3273 )	7 years ago
James Bardin	deb43fea6b	accept recv-only channels for cancellations (#3271 ) Cancellation channels are often derived from a Context, which returns a directional `<-chan struct{}` from Done(). In order to use this with parts of of the consul API, one is required to create a new channel and dispatch a separate goroutine to watch for context cancellation and close the new channel. Changing the signature for the methods that take cancellation channels will allow easier integration with existing uses of Context. Since the cancellation pattern only reads from these channels, there should be no backwards incompatibility with existing codebases, and most of the methods already accept only the correct type.	7 years ago
Frank Schroeder	9c54f30c94	api: fix TestAPI_CatalogNodes test	8 years ago
Frank Schroeder	0e931a713c	agent: fix failing test from localState decoupling Would be nice to know what changed though.	8 years ago
Frank Schroeder	7bbfef7000	api: refactor: unify naming of API tests	8 years ago
Frank Schroeder	8edeabce9a	api: refactor: prefix all API tests with API_	8 years ago
Preetha Appan	9eaf56bfe3	Fix socket file handle leaks from old blocking queries upon consul reload. This fixes issue #3018	8 years ago
Frank Schröder	825f72f5ef	agent: support custom header and method for http checks (#3106 ) This patch adds support for custom headers and method for HTTP checks. Fixes #2474 Fixes #2657 Fixes #3106	8 years ago
James Phillips	3baa703d02	Merge pull request #3077 from jwasinger/issue-2850 Prevent Session.Destroy from leaving open TCP connections	8 years ago
Jared Wasinger	d2ef61d079	Prevent Session.Destroy from leaving open TCP connections	8 years ago
Kyle Havlovitz	4e44db87e3	Don't overwrite Transport's TLS config if it's been set	8 years ago
Kyle Havlovitz	04f1ff78f8	Remove superfluous default HttpClient check in NewClient	8 years ago
Frank Schroeder	96c677fdba	test: make test less flaky	8 years ago
Frank Schroeder	65b5c51ec7	test: add helper for ioutil.TempDir/TempFile This creates a simplified helper for temporary directories and files. All path names are prefixed with the name of the current test. All files and directories are stored either in /tmp/consul-test or /tmp if the former could not be created. Using the system temp dir breaks some tests on macOS where the unix socket path becomes too long.	8 years ago
Frank Schroeder	3522a41bad	test: include test name in temp file/dir This helps identifying hanging tests by looking at the process list.	8 years ago
James Phillips	c1d196152f	Fixes vet errors.	8 years ago
James Phillips	ddfa57765c	retry: Removes the description parameter.	8 years ago
Frank Schroeder	21a82a0a16	test: Refactor WaitForResult tests with retry Refactor tests that use testutil.WaitForResult to use retry. Since this requires refactoring the test functions in general this patch also shows the use of the github.com/pascaldekloe/goe/verify library which provides a good mechanism for comparing nested data structures. Instead of just converting the tests from testutil.WaitForResult to retry the tests that performing a nested comparison of data structures are converted to the verify library at the same time.	8 years ago
Kyle Havlovitz	cd56a5ebdd	Add separate option for verifying incoming HTTPS traffic (#2974 ) * Add separate option for verifying incoming HTTPS traffic	8 years ago
Frank Schroeder	9685bdcd0b	api: Add ServiceTags to Health state endpoint (#153 ) This patch adds the ServiceTags to the /v1/health/state/<state> endpoint. Fixes #153	8 years ago
James Phillips	05b1cabba9	Merge pull request #2947 from bogdanov1609/added_ACLReplication API: Add ACLReplication	8 years ago
James Phillips	36725cef11	Tweaks ACL replication struct name.	8 years ago
James Phillips	138abeb5f7	Tweaks ACL replication status struct name.	8 years ago
Frank Schroeder	3e00e36f41	golint: Untangle if blocks with return in else	8 years ago
Ivan Bogdanov	1ebd6402fd	API: Add ACLReplication	8 years ago
Frank Schröder	6dd2804d09	Issue #2905 : Add check-not-exists to TXN endpoint This patch adds support for asserting that a given key does not exist in the KV store. Fixes #2905	8 years ago
Kyle Havlovitz	c6d0b4cf90	Make the API client's httpClient more pluggable (#2926 )	8 years ago
Frank Schröder	c40621ae10	Add datacenter to catalog node API (#2917 ) This patch stores the datacenter of a node in memdb and exposes it via the API in all places where a Node structure is returned. * /catalog/nodes * /catalog/node/:node * /catalog/service/:service * /health/service/:service * /query/:uuid/execute	8 years ago
Kyle Havlovitz	ae6bf56ee1	Add tls client options to api/cli	8 years ago

... 3 4 5 6 7 ...

659 Commits (ae05419aeacb887c0a0697f01ff625a2432766d4)