2115 Commits (b3db907bdfc25bbc239058b64b0a0b3904560c59)

Author	SHA1	Message	Date
Chris Piraino	b3db907bdf	Update gateway-services-nodes API endpoint to allow multiple addresses ... Previously, we were only returning a single ListenerPort for a single service. However, we actually allow a single service to be serviced over multiple ports, as well as allow users to define what hostnames they expect their services to be contacted over. When no hosts are defined, we return the default ingress domain for any configured DNS domain. To show this in the UI, we modify the gateway-services-nodes API to return a GatewayConfig.Addresses field, which is a list of addresses over which the specific service can be contacted.	4 years ago
Pierre Souchay	35d852fd9a	Returns DNS Error NSDOMAIN when DC does not exists (#8103) ... This will allow to increase cache value when DC is not valid (aka return SOA to avoid too many consecutive requests) and will distinguish DC being temporarily not available from DC not existing. Implements https://github.com/hashicorp/consul/issues/8102	4 years ago
Matt Keeler	4a5b352c18	Require enabling TLS to enable Auto Config (#8159) ... On the servers they must have a certificate. On the clients they just have to set verify_outgoing to true to attempt TLS connections for RPCs. Eventually we may relax these restrictions but right now all of the settings we push down (acl tokens, acl related settings, certificates, gossip key) are sensitive and shouldn’t be transmitted over an unencrypted connection. Our guides and docs should recoommend verify_server_hostname on the clients as well. Another reason to do this is weird things happen when making an insecure RPC when TLS is not enabled. Basically it tries TLS anyways. We should probably fix that to make it clearer what is going on.	5 years ago
Freddy	5baa7b1b04	Always return a gateway cluster (#8158)	5 years ago
Matt Keeler	d6e05482ab	Allow cancelling startup when performing auto-config (#8157) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	5 years ago
Daniel Nephin	4f17350928	Merge pull request #8147 from hashicorp/dnephin/remove-private-ip-2 ... Remove some dead code from agent/consul/util.go	5 years ago
Matt Keeler	b0fcf86140	Change auto config authorizer to allow for future extension ... The envisioned changes would allow extra settings to enable dynamically defined auth methods to be used instead of or in addition to the statically defined one in the configuration.	5 years ago
Daniel Nephin	b0ba546a1f	Remove bytesToUint64 from agent/consul	5 years ago
Daniel Nephin	a00f007c5e	Remove unused private IP code from agent/consul	5 years ago
Matt Keeler	3dbbd2d37d	Implement Client Agent Auto Config ... There are a couple of things in here. First, just like auto encrypt, any Cluster.AutoConfig RPC will implicitly use the less secure RPC mechanism. This drastically modifies how the Consul Agent starts up and moves most of the responsibilities (other than signal handling) from the cli command and into the Agent.	5 years ago
Matt Keeler	8b7d669a27	Allow the Agent its its child Client/Server to share a connection pool ... This is needed so that we can make an AutoConfig RPC at the Agent level prior to creating the Client/Server.	5 years ago
Matt Keeler	51c3a605ad	Merge pull request #8035 from hashicorp/feature/auto-config/server-rpc	5 years ago
Chris Piraino	79a862d019	Remove ACLEnforceVersion8 from tests (#8138) ... The field had been deprecated for a while and was recently removed, however a PR which added these tests prior to removal was merged.	5 years ago
Daniel Nephin	692a4a8fc8	Merge pull request #7762 from hashicorp/dnephin/warn-on-unknown-service-file ... config: warn if a config file is being skipped because of its file extension	5 years ago
Daniel Nephin	be29d6bf75	config: warn when a config file is skipped ... All commands which read config (agent, services, and validate) will now print warnings when one of the config files is skipped because it did not match an expected format. Also ensures that config validate prints all warnings.	5 years ago
Daniel Nephin	5afcf5c1bc	Merge pull request #8034 from hashicorp/dnephin/add-linter-staticcheck-4 ... ci: enable SA4006 staticcheck check and add ineffassign	5 years ago
Matt Keeler	9b01f9423c	Implement the insecure version of the Cluster.AutoConfig RPC endpoint ... Right now this is only hooked into the insecure RPC server and requires JWT authorization. If no JWT authorizer is setup in the configuration then we inject a disabled “authorizer” to always report that JWT authorization is disabled.	5 years ago
Pierre Souchay	d31691dc87	gossip: Ensure that metadata of Consul Service is updated (#7903) ... While upgrading servers to a new version, I saw that metadata of existing servers are not upgraded, so the version and raft meta is not up to date in catalog. The only way to do it was to: * update Consul server * make it leave the cluster, then metadata is accurate That's because the optimization to avoid updating catalog does not take into account metadata, so no update on catalog is performed.	5 years ago
Daniel Nephin	d345cd8d30	ci: Add ineffsign linter ... And fix an additional ineffective assignment that was not caught by staticcheck	5 years ago
Daniel Nephin	a9851e1812	Merge pull request #8070 from hashicorp/dnephin/add-gofmt-simplify ... ci: Enable gofmt simplify	5 years ago
Matt Keeler	9f7b22a5eb	Agent Auto Configuration: Configuration Syntax Updates (#8003)	5 years ago
Daniel Nephin	068b43df90	Enable gofmt simplify ... Code changes done automatically with 'gofmt -s -w'	5 years ago
Daniel Nephin	cb050b280c	ci: enable SA4006 staticcheck check ... And fix the 'value not used' issues. Many of these are not bugs, but a few are tests not checking errors, and one appears to be a missed error in non-test code.	5 years ago
Daniel Nephin	f7c84ad802	Rename txnWrapper to txn	5 years ago
Daniel Nephin	32aa3ada35	Rename db	5 years ago
Daniel Nephin	deef6fcc32	Handle return value from txn.Commit	5 years ago
Daniel Nephin	59bac0f99d	state: Update docstrings for changeTrackerDB and txn ... And un-embed memdb.DB to prevent accidental access to underlying methods.	5 years ago
Paul Banks	f6ac08be04	state: track changes so that they may be used to produce change events	5 years ago
Matt Keeler	d3881dd754	ACL Node Identities (#7970) ... A Node Identity is very similar to a service identity. Its main targeted use is to allow creating tokens for use by Consul agents that will grant the necessary permissions for all the typical agent operations (node registration, coordinate updates, anti-entropy). Half of this commit is for golden file based tests of the acl token and role cli output. Another big updates was to refactor many of the tests in agent/consul/acl_endpoint_test.go to use the same style of tests and the same helpers. Besides being less boiler plate in the tests it also uses a common way of starting a test server with ACLs that should operate without any warnings regarding deprecated non-uuid master tokens etc.	5 years ago
Daniel Nephin	476b57fe22	config: refactor to consolidate all File->Source loading ... Previously the logic for reading ConfigFiles and produces Sources was split between NewBuilder and Build. This commit moves all of the logic into NewBuilder so that Build() can operate entirely on Sources. This change is in preparation for logging warnings when files have an unsupported extension. It also reduces the scope of BuilderOpts, and gets us very close to removing Builder.options.	5 years ago
Daniel Nephin	219790ca49	config: Make ConfigFormat not a pointer ... The nil value was never used. We can avoid a bunch of complications by making the field a string value instead of a pointer. This change is in preparation for fixing a silent config failure.	5 years ago
Daniel Nephin	77101eee82	config: rename Flags to BuilderOpts ... Flags is an overloaded term in this context. It generally is used to refer to command line flags. This struct, however, is a data object used as input to the construction. It happens to be partially populated by command line flags, but otherwise has very little to do with them. Renaming this struct should make the actual responsibility of this struct more obvious, and remove the possibility that it is confused with command line flags. This change is in preparation for adding additional fields to BuilderOpts.	5 years ago
Daniel Nephin	85e0338136	config: remove Args field from Flags ... This field was populated for one reason, to test that it was empty. Of all the callers, only a single one used this functionality. The rest constructed a `Flags{}` struct which did not set Args. I think this shows that the logic was in the wrong place. Only the agent command needs to care about validating the args. This commit removes the field, and moves the logic to the one caller that cares. Also fix some comments.	5 years ago
Daniel Nephin	73cd0b6fac	agent/service_manager: remove 'updateCh' field from serviceConfigWatch ... Passing the channel to the function which uses it significantly reduces the scope of the variable, and makes its usage more explicit. It also moves the initialization of the channel closer to where it is used. Also includes a couple very small cleanups to remove a local var and read the error from `ctx.Err()` directly instead of creating a channel to check for an error.	5 years ago
Daniel Nephin	26291a8482	agent/service_manager: remove 'defaults' field from serviceConfigWatch ... This field was always read by the same function that populated the field, so it does not need to be a field. Passing the value as an argument to functions makes it more obvious where the value comes from, and also reduces the scope of the variable significantly.	5 years ago
Daniel Nephin	93235da253	agent/service_manager: Pass ctx around ... [The documentation for context](https://golang.org/pkg/context/) recommends not storing context in a struct field: > Do not store Contexts inside a struct type; instead, pass a Context > explicitly to each function that needs it. The Context should be the > first parameter, typically named ctx... Sometimes there are good reasons to not follow this recommendation, but in this case it seems easy enough to follow. Also moved the ctx argument to be the first in one of the function calls to follow the same recommendation.	5 years ago
Daniel Nephin	2eac5b8023	Merge pull request #8074 from hashicorp/dnephin/remove-references-to-PatchSliceOfMaps ... Update comments that reference PatchSliceOfMaps	5 years ago
Matt Keeler	8837907de4	Make the Agent Cache more Context aware (#8092) ... Blocking queries issues will still be uncancellable (that cannot be helped until we get rid of net/rpc). However this makes it so that if calling getWithIndex (like during a cache Notify go routine) we can cancell the outer routine. Previously it would keep issuing more blocking queries until the result state actually changed.	5 years ago
freddygv	d97cff0966	Update telemetry for gateway-services endpoint	5 years ago
freddygv	cd927eed5e	Remove unused method and fixup docs ref	5 years ago
freddygv	0f97b7d63d	Fixup stray sid references	5 years ago
freddygv	19e3954603	Move compound service names to use ServiceName type	5 years ago
freddygv	e7b52d35d4	Create HTTP endpoint	5 years ago
freddygv	15c74d6943	Move GatewayServices out of Internal	5 years ago
Freddy	166a8b2a58	Only pass one hostname via EDS and prefer healthy ones (#8084) ... Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Currently when passing hostname clusters to Envoy, we set each service instance registered with Consul as an LbEndpoint for the cluster. However, Envoy can only handle one per cluster: [2020-06-04 18:32:34.094][1][warning][config] [source/common/config/grpc_subscription_impl.cc:87] gRPC config for type.googleapis.com/envoy.api.v2.Cluster rejected: Error adding/updating cluster(s) dc2.internal.ddd90499-9b47-91c5-4616-c0cbf0fc358a.consul: LOGICAL_DNS clusters must have a single locality_lb_endpoint and a single lb_endpoint, server.dc2.consul: LOGICAL_DNS clusters must have a single locality_lb_endpoint and a single lb_endpoint Envoy is currently handling this gracefully by only picking one of the endpoints. However, we should avoid passing multiple to avoid these warning logs. This PR: * Ensures we only pass one endpoint, which is tied to one service instance. * We prefer sending an endpoint which is marked as Healthy by Consul. * If no endpoints are healthy we emit a warning and skip the cluster. * If multiple unique hostnames are spread across service instances we emit a warning and let the user know which will be resolved.	5 years ago
Chris Piraino	6fa48c9512	Allow users to set hosts to the wildcard specifier when TLS is disabled (#8083) ... This allows easier demoing/testing of ingress gateways, while still preserving the validation we have for DNSSANs	5 years ago
Chris Piraino	91ab89dd48	Move ingress param to a new endpoint (#8081) ... In discussion with team, it was pointed out that query parameters tend to be filter mechanism, and that semantically the "/v1/health/connect" endpoint should return "all healthy connect-enabled endpoints (e.g. could be side car proxies or native instances) for this service so I can connect with mTLS". That does not fit an ingress gateway, so we remove the query parameter and add a new endpoint "/v1/health/ingress" that semantically means "all the healthy ingress gateway instances that I can connect to to access this connect-enabled service without mTLS"	5 years ago
Daniel Nephin	8ec029ae6a	Update comments that reference PatchSliceOfMaps ... To reference decode.HookWeakDecodeFromSlice instead. Also removes a step from the adding config fields checklist which is no longer necessary.	5 years ago
Chris Piraino	496e683360	Merge pull request #8064 from hashicorp/ingress/health-query-param ... Add API query parameter ?ingress to allow users to find ingress gateways associated to a service	5 years ago
Chris Piraino	c1d329c5dd	Remove TODO note about ingress API, it is done!	5 years ago