2115 Commits (b3db907bdfc25bbc239058b64b0a0b3904560c59)

Author	SHA1	Message	Date
Kyle Havlovitz	f9672f9bf1	Make sure IngressHosts isn't parsed during JSON decode	5 years ago
Chris Piraino	c44f877758	Comment why it is ok to expect upstreams slice to not be empty	5 years ago
Chris Piraino	881760f701	xds: Use only the port number as the configured route name ... This removes duplication of protocol from the stats_prefix	5 years ago
Kyle Havlovitz	89e6b16815	Filter wildcard gateway services to match listener protocol ... This now requires some type of protocol setting in ingress gateway tests to ensure the services are not filtered out. - small refactor to add a max(x, y) function - Use internal configEntryTxn function and add MaxUint64 to lib	5 years ago
Chris Piraino	f40833d094	Allow Hosts field to be set on an ingress config entry ... - Validate that this cannot be set on a 'tcp' listener nor on a wildcard service. - Add Hosts field to api and test in consul config write CLI - xds: Configure envoy with user-provided hosts from ingress gateways	5 years ago
Chris Piraino	b73a13fc9e	Remove service_subset field from ingress config entry ... We decided that this was not a useful MVP feature, and just added unnecessary complexity	5 years ago
Kyle Havlovitz	711d1389aa	Support multiple listeners referencing the same service in gateway definitions	5 years ago
Kyle Havlovitz	247f9eaf13	Allow ingress gateways to route traffic based on Host header ... This commit adds the necessary changes to allow an ingress gateway to route traffic from a single defined port to multiple different upstream services in the Consul mesh. To do this, we now require all HTTP requests coming into the ingress gateway to specify a Host header that matches "<service-name>.*" in order to correctly route traffic to the correct service. - Differentiate multiple listener's route names by port - Adds a case in xds for allowing default discovery chains to create a route configuration when on an ingress gateway. This allows default services to easily use host header routing - ingress-gateways have a single route config for each listener that utilizes domain matching to route to different services.	5 years ago
R.B. Boyer	a854e4d9c5	acl: oss plumbing to support auth method namespace rules in enterprise (#7794) ... This includes website docs updates.	5 years ago
R.B. Boyer	3242d0816d	test: make the kube auth method test helper use freeport (#7788)	5 years ago
Hans Hasselberg	096a2f2f02	network_segments: stop advertising segment tags	5 years ago
Hans Hasselberg	995a24b8e4	agent: refactor to use a single addrFn	5 years ago
Hans Hasselberg	6994c0d47f	agent: rename local/global to src/dst	5 years ago
Chris Piraino	69b44fb942	Construct a default destination if one does not exist for service-router (#7783)	5 years ago
R.B. Boyer	22eb016153	acl: add MaxTokenTTL field to auth methods (#7779) ... When set to a non zero value it will limit the ExpirationTime of all tokens created via the auth method.	5 years ago
R.B. Boyer	ca52ba7068	acl: add DisplayName field to auth methods (#7769) ... Also add a few missing acl fields in the api.	5 years ago
Hans Hasselberg	c4093c87cc	agent: don't let left nodes hold onto their node-id (#7747)	5 years ago
Matt Keeler	daec810e34	Merge pull request #7714 from hashicorp/oss-sync/msp-agent-token	5 years ago
Matt Keeler	cbe3a70f56	Update enterprise configurations to be in OSS ... This will emit warnings about the configs not doing anything but still allow them to be parsed. This also added the warnings for enterprise fields that we already had in OSS but didn’t change their enforcement behavior. For example, attempting to use a network segment will cause a hard error in OSS.	5 years ago
R.B. Boyer	9533451a63	acl: refactor the authmethod.Validator interface (#7760) ... This is a collection of refactors that make upcoming PRs easier to digest. The main change is the introduction of the authmethod.Identity struct. In the one and only current auth method (type=kubernetes) all of the trusted identity attributes are both selectable and projectable, so they were just passed around as a map[string]string. When namespaces were added, this was slightly changed so that the enterprise metadata can also come back from the login operation, so login now returned two fields. Now with some upcoming auth methods it won't be true that all identity attributes will be both selectable and projectable, so rather than update the login function to return 3 pieces of data it seemed worth it to wrap those fields up and give them a proper name.	5 years ago
R.B. Boyer	54ba8e3868	acl: change authmethod.Validator to take a logger (#7758)	5 years ago
R.B. Boyer	8927b54121	test: move some test helpers over from enterprise (#7754)	5 years ago
R.B. Boyer	b282268408	sdk: extracting testutil.RequireErrorContains from various places it was duplicated (#7753)	5 years ago
Hans Hasselberg	51549bd232	rpc: oss changes for network area connection pooling (#7735)	5 years ago
Freddy	021f0ee36e	Watch fallback channel for gateways that do not exist (#7715) ... Also ensure that WatchSets in tests are reset between calls to watchFired. Any time a watch fires, subsequent calls to watchFired on the same WatchSet will also return true even if there were no changes.	5 years ago
Matt Keeler	7a4c73acaf	Updates to allow for using an enterprise specific token as the agents token ... This is needed to allow for managed Consul instances to register themselves in the catalog with one of the managed service provider tokens.	5 years ago
Matt Keeler	bec3fb7c18	Some boilerplate to allow for ACL Bootstrap disabling configurability	5 years ago
Freddy	137a2c32c6	TLS Origination for Terminating Gateways (#7671)	5 years ago
freddygv	4710410cb5	Remove fallthrough	5 years ago
freddygv	d1e6d668c2	Add authz filter when creating filterchain	5 years ago
freddygv	034d7d83d4	Fix snapshot IsEmpty	5 years ago
freddygv	3afe816a94	Clean up dead code, issue addressed by passing ws to serviceGatewayNodes	5 years ago
Freddy	3b1b24c2ce	Update agent/proxycfg/state_test.go	5 years ago
freddygv	eddd5bd73b	PR comments	5 years ago
freddygv	77bb2f1002	Fix internal endpoint test	5 years ago
freddygv	d82e7e8c2a	Fix listener error handling	5 years ago
freddygv	6abc71f915	Skip filter chain creation if no client cert	5 years ago
freddygv	915db10903	Avoid deleting mappings for services linked to other gateways on dereg	5 years ago
freddygv	cd28d4125d	Re-fix bug in CheckConnectServiceNodes	5 years ago
freddygv	09a8e5f36d	Use golden files for gateway certs and fix listener test flakiness	5 years ago
freddygv	840d27a9d5	Un-nest switch in gateway update handler	5 years ago
freddygv	c0e1751878	Allow terminating-gateway to setup listener before servicegroups are known	5 years ago
freddygv	913b13f31f	Add subset support	5 years ago
freddygv	9f233dece2	Fix ConnectQueryBlocking test	5 years ago
freddygv	86342e4bca	Fix bug in CheckConnectServiceNodes ... Previously, if a blocking query called CheckConnectServiceNodes before the gateway-services memdb table had any entries, a nil watchCh would be returned when calling serviceTerminatingGatewayNodes. This means that the blocking query would not fire if a gateway config entry was added after the watch started. In cases where the blocking query started on proxy registration, the proxy could potentially never become aware of an upstream endpoint if that upstream was going to be represented by a gateway.	5 years ago
freddygv	219c78e586	Add xds cluster/listener/endpoint management	5 years ago
freddygv	24207226ca	Add proxycfg state management for terminating-gateways	5 years ago
freddygv	c9385129ae	Require service:read to read terminating-gateway config	5 years ago
Matt Keeler	a1648c61ae	A couple testing helper updates (#7694)	5 years ago
Kit Patella	df14a7c694	Merge pull request #7699 from pierresouchay/fix_comment_misplaced ... Fixed comment on wrong line	5 years ago
Chris Piraino	ecc8a2d6f7	Allow ingress gateways to route through mesh gateways ... - Adds integration test for mesh gateways local + remote modes with ingress - ingress golden files updated for mesh gateway endpoints	5 years ago
Chris Piraino	cb9df538d5	Add all the xds ingress tests ... This commit copies many of the connect-proxy xds testcases and reuses for ingress gateways. This allows us to more easily see changes to the envoy configuration when make updates to ingress gateways.	5 years ago
Chris Piraino	0ca9b606e8	Pull out setupTestVariationConfigEntriesAndSnapshot in proxycfg ... This allows us to reuse the same variations for ingress gateway testing	5 years ago
Kyle Havlovitz	e7b1ee55de	Add http routing support and integration test to ingress gateways	5 years ago
Hans Hasselberg	1194fe441f	auto_encrypt: add validations for auto_encrypt.{tls,allow_tls} (#7704) ... Fixes https://github.com/hashicorp/consul/issues/7407.	5 years ago
Pierre Souchay	5e79efc80f	Fixed comment on wrong line. ... While investigating and fixing an issue on our 1.5.1 branch, I saw you also/already fixed the bug I found (tags not updated for existing servers), but comment is misplaced.	5 years ago
Freddy	3956cff60f	Fix check deletion in anti-entropy sync (#7690) ... * Incorporate entMeta into service equality check	5 years ago
Daniel Nephin	d6e22a77e3	Remove deadcode ... This UnmarshalJSON was never called. The decode function is passed a map[string]interface so it has no way of knowing that this function exists. Tested by adding a panic to this function and watching the tests pass. I attempted to use this Unmarshal function by passing in the type, however the tests showed that it does not work. The test was failing to parse the request. If the performance of this endpoint is indeed critical we can solve the problem by adding all the fields to the request struct and handling the normalziation without a custom Unmarshal.	5 years ago
Daniel Nephin	ff0d894101	agent: remove deadcode that called lib.TranslateKeys ... Move the last remaining function from agent/config.go to the one place it was called.	5 years ago
Chris Piraino	115d2d5db5	Expect default enterprise metadata in gateway tests (#7664) ... This makes it so that both OSS and enterprise tests pass correctly In the api tests, explicitly set namespace to empty string so that tests can be shared.	5 years ago
Kit Patella	ccece5cd21	http: rename paresTokenResolveProxy to parseTokenWithDefault	5 years ago
Kit Patella	e2467f4b2c	Merge pull request #7656 from hashicorp/feature/audit/oss-merge ... agent: stub out auditing functionality in OSS	5 years ago
Kit Patella	3b105435b8	agent,config: port enterprise only fields to embedded enterprise structs	5 years ago
Daniel Nephin	67d14d8349	Merge pull request #7641 from hashicorp/dnephin/agent-cache-request-info ... agent/cache: reduce function arguments by removing duplicates	5 years ago
Chris Piraino	6ef8ae9965	Fix bug where non-typical services are associated with gateways (#7662) ... On every service registration, we check to see if a service should be assassociated to a wildcard gateway-service. This fixes an issue where we did not correctly check to see if the service being registered was a "typical" service or not.	5 years ago
Daniel Nephin	81755c860a	agent/cache: remove error return from fetch ... A previous change removed the only error, so the return value can be removed now.	5 years ago
Daniel Nephin	4ef9fc9f27	agent/cache: reduce function arguments by removing duplicates ... A few of the unexported functions in agent/cache took a large number of arguments. These arguments were effectively overrides for values that were provided in RequestInfo. By using a struct we can not only reduce the number of arguments, but also simplify the logic by removing the need for overrides.	5 years ago
Kit Patella	4a86cb12c1	config/runtime: fix an extra field in config sanitize	5 years ago
Daniel Nephin	5fe7043439	agent/cache: Make all cache options RegisterOptions ... Previously the SupportsBlocking option was specified by a method on the type, and all the other options were specified from RegisterOptions. This change moves RegisterOptions to a method on the type, and moves SupportsBlocking into the options struct. Currently there are only 2 cache-types. So all cache-types can implement this method by embedding a struct with those predefined values. In the future if a cache type needs to be registered more than once with different options it can remove the embedded type and implement the method in a way that allows for paramaterization.	5 years ago
Kit Patella	927f584761	agent: stub out auditing functionality in OSS	5 years ago
Kyle Havlovitz	e9e8c0e730	Ingress Gateways for TCP services (#7509) ... * Implements a simple, tcp ingress gateway workflow This adds a new type of gateway for allowing Ingress traffic into Connect from external services. Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Daniel Nephin	f46d1b5c94	agent/structs: Remove ServiceID.Init and CheckID.Init ... The Init method provided the same functionality as the New constructor. The constructor is both more widely used, and more idiomatic, so remove the Init method. This change is in preparation for fixing printing of these IDs.	5 years ago
sasha	ac9b330f6b	add DNSSAN and IPSAN to cache key (#7597)	5 years ago
Matt Keeler	6a78c24d67	Update the Client code to use the common version checking infra… (#7558) ... Also reduce the log level of some version checking messages on the server as they can be pretty noisy during upgrades and really are more for debugging purposes.	5 years ago
Matt Keeler	da893c36a1	Allow the bootstrap endpoint to be disabled in enterprise. (#7614)	5 years ago
Daniel Nephin	89f41bddfe	Remove TTL from cacheEntryExpiry ... This should very slightly reduce the amount of memory required to store each item in the cache. It will also enable setting different TTLs based on the type of result. For example we may want to use a shorter TTL when the result indicates the resource does not exist, as storing these types of records could easily lead to a DOS caused by OOM.	5 years ago
Daniel Nephin	7246d8b6cb	agent/cache: Reduce differences between notify implementations ... These two notify functions are very similar. There appear to be just enough differences that trying to parameterize the differences may not improve things. For now, reduce some of the cosmetic differences so that the material differences are more obvious.	5 years ago
Daniel Nephin	66fbb13976	agent/cache: Inline the refresh function to make recursion more obvious ... fetch is already an exceptionally long function, but hiding the recrusion in a function call likely does not help.	5 years ago
Daniel Nephin	faeaed5d0c	agent/cache: Make the return values of getEntryLocked more obvious ... Use named returned so that the caller has a better idea of what these bools mean. Return early to reduce the scope, and make it more obvious what values are returned in which cases. Also reduces the number of conditional expressions in each case.	5 years ago
Daniel Nephin	e9e45545dd	agent/cache: Small formatting improvements to improve readability ... Remove Cache.entryKey which called a single function. Format multiline struct creation one field per line.	5 years ago
Daniel Nephin	329d76fd0e	Remove SnapshotRPC passthrough ... The caller has access to the delegate, so we do not gain anything by wrapping the call in Agent.	5 years ago
Daniel Nephin	1f25bf88b8	Merge pull request #7596 from hashicorp/dnephin/agent-cache-type-entry ... agent/cache: move typeEntry lookup to the edge	5 years ago
Pierre Souchay	1b4218a068	fix flaky TestReplication_FederationStates test due to race conditions (#7612) ... The test had two racy bugs related to memdb references. The first was when we initially populated data and retained the FederationState objects in a slice. Due to how the `inmemCodec` works these were actually the identical objects passed into memdb. The second was that the `checkSame` assertion function was reading from memdb and setting the RaftIndexes to zeros to aid in equality checks. This was mutating the contents of memdb which is a no-no. With this fix, the command: ``` i=0; while /usr/local/bin/go test -count=1 -timeout 30s github.com/hashicorp/consul/agent/consul -run '^(TestReplication_FederationStates)$'; do i=$((i + 1)); printf "$i "; done ``` That used to break on my machine in less than 20 runs is now running 150+ times without any issue. Might also fix #7575	5 years ago
Pierre Souchay	4a6569a4e3	tests: change default http_max_conns_per_client to 250 to ease tests (#7625) ... On recent Mac OS versions, the ulimit defaults to 256 by default, but many systems (eg: some Linux distributions) often limit this value to 1024. On validation of configuration, Consul now validates that the number of allowed files descriptors is bigger than http_max_conns_per_client. This make some unit tests failing on Mac OS. Use a less important value in unit test, so tests runs well by default on Mac OS without need for tuning the OS.	5 years ago
Freddy	9eb1867fbb	Terminating gateway discovery (#7571) ... * Enable discovering terminating gateways * Add TerminatingGatewayServices to state store * Use GatewayServices RPC endpoint for ingress/terminating	5 years ago
Freddy	aae14b3951	Add decode rules for Expose cfg in service-defaults (#7611)	5 years ago
Matt Keeler	0e7d3d93b3	Enable filtering language support for the v1/connect/intentions… (#7593) ... * Enable filtering language support for the v1/connect/intentions listing API * Update website for filtering of Intentions * Update website/source/api/connect/intentions.html.md	5 years ago
Daniel Nephin	8549cc2d99	Merge pull request #7598 from pierresouchay/preallocation_of_dns_meta ... Pre-allocations of DNS meta to avoid several allocations	5 years ago
Pierre Souchay	d1d016d61d	[LINT] Close resp.Body to avoid linter complaining (#7600)	5 years ago
Pierre Souchay	c9e01ed0a3	Pre-allocations of DNS meta to avoid several allocations	5 years ago
Daniel Nephin	c9a87be6ee	agent/cache: move typeEntry lookup to the edge ... This change moves all the typeEntry lookups to the first step in the exported methods, and makes unexporter internals accept the typeEntry struct. This change is primarily intended to make it easier to extract the container of caches from the Cache type. It may incidentally reduce locking in fetch, but that was not a goal.	5 years ago
Pierre Souchay	73056fecf8	Fixed unstable test TestForwardSignals() ... Sometimes, in the CI, it could receive a SIGURG, producing this line: FAIL: TestForwardSignals/signal-interrupt (0.06s) util_test.go:286: expected to read line "signal: interrupt" but got "signal: urgent I/O condition" Only forward the signals we test to avoid this kind of false positive Example of such unstable errors in CI: https://circleci.com/gh/hashicorp/consul/153571	5 years ago
Pierre Souchay	09e638a9c6	tests: more tolerance to latency for unstable test `TestCacheNotifyPolling()`. (#7574)	5 years ago
Matt Keeler	8aec09aa8f	Ensure that token clone copies the roles (#7577)	5 years ago
Chris Piraino	584f90bbeb	Fix flapping of mesh gateway connect-service watches (#7575)	5 years ago
Pierre Souchay	2a8bf45e38	agent: show warning when enable_script_checks is enabled without safty net (#7437) ... In order to enforce a bit security on Consul agents, add a new method in agent to highlight possible security issues. This does not return an error for now, but might in the future. For now, it detects issues such as: https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/ This would display this kind of messages: ``` 2020-03-11T18:27:49.873+0100 [ERROR] agent: [SECURITY] issue: error="using enable-script-checks without ACLs and without allow_write_http_from is DANGEROUS, use enable-local-script-checks instead see https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/" ```	5 years ago
Andy Lindeman	fb0a990e4d	agent: rewrite checks with proxy address, not local service address (#7518) ... Exposing checks is supposed to allow a Consul agent bound to a different IP address (e.g., in a different Kubernetes pod) to access healthchecks through the proxy while the underlying service binds to localhost. This is an important security feature that makes sure no external traffic reaches the service except through the proxy. However, as far as I can tell, this is subtly broken in the case where the Consul agent cannot reach the proxy over localhost. If a proxy is configured with: `{ LocalServiceAddress: "127.0.0.1", Checks: true }`, as is typical with a sidecar proxy, the Consul checks are currently rewritten to `127.0.0.1:<random port>`. A Consul agent that does not share the loopback address cannot reach this address. Just to make sure I was not misunderstanding, I tried configuring the proxy with `{ LocalServiceAddress: "<pod ip>", Checks: true }`. In this case, while the checks are rewritten as expected and the agent can reach the dynamic port, the proxy can no longer reach its backend because the traffic is no longer on the loopback interface. I think rewriting the checks to use `proxy.Address`, the proxy's own address, is more correct in this case. That is the IP where the proxy can be reached, both by other proxies and by a Consul agent running on a different IP. The local service address should continue to use `127.0.0.1` in most cases.	5 years ago
Andy Lindeman	c1cb18c648	proxycfg: support path exposed with non-HTTP2 protocol (#7510) ... If a proxied service is a gRPC or HTTP2 service, but a path is exposed using the HTTP1 or TCP protocol, Envoy should not be configured with `http2ProtocolOptions` for the cluster backing the path. A situation where this comes up is a gRPC service whose healthcheck or metrics route (e.g. for Prometheus) is an HTTP1 service running on a different port. Previously, if these were exposed either using `Expose: { Checks: true }` or `Expose: { Paths: ... }`, Envoy would still be configured to communicate with the path over HTTP2, which would not work properly.	5 years ago
Pierre Souchay	be1c5c4b48	config: validate system limits against limits.http_max_conns_per_client (#7434) ... I spent some time today on my local Mac to figure out why Consul 1.6.3+ was not accepting limits.http_max_conns_per_client. This adds an explicit check on number of file descriptors to be sure it might work (this is no guarantee as if many clients are reaching the agent, it might consume even more file descriptors) Anyway, many users are fighting with RLIMIT_NOFILE, having a clear message would allow them to figure out what to fix. Example of message (reload or start): ``` 2020-03-11T16:38:37.062+0100 [ERROR] agent: Error starting agent: error="system allows a max of 512 file descriptors, but limits.http_max_conns_per_client: 8192 needs at least 8212" ```	5 years ago
Shaker Islam	ac309d55f4	docs: document exported functions in agent.go (closes #7101) (#7366) ... and fix one linter error	5 years ago
Pierre Souchay	08acd6a03e	[FIX BUILD] fix build due to merge of #7562 ... Due to merge #7562, upstream does not compile anymore. Error is: ERRO Running error: gofmt: analysis skipped: errors in package: [/Users/p.souchay/go/src/github.com/hashicorp/consul/agent/config_endpoint_test.go:188:33: too many arguments]	5 years ago
Daniel Nephin	0d8edc3e27	Merge pull request #7562 from hashicorp/dnephin/remove-tname-from-name ... testing: Remove old default value from NewTestAgent() calls	5 years ago
Daniel Nephin	190fc3c732	Merge pull request #7533 from hashicorp/dnephin/xds-server-1 ... agent/xds: small cleanup	5 years ago
Emre Savcı	2083b7b04d	agent: add len, cap while initializing arrays	5 years ago
Daniel Nephin	e759daafdd	Rename NewTestAgentWithFields to StartTestAgent ... This function now only starts the agent. Using: git grep -l 'StartTestAgent(t, true,' | \ xargs sed -i -e 's/StartTestAgent(t, true,/StartTestAgent(t,/g'	5 years ago
Daniel Nephin	f9f6b14533	Convert the remaining calls to NewTestAgentWithFields ... After removing the t.Name() parameter with sed, convert the last few tests which use a custom name to call NewTestAgentWithFields instead.	5 years ago
Daniel Nephin	0c409d460f	Merge pull request #7470 from hashicorp/dnephin/dns-unused-params ... dns: Remove a few unused function parameters	5 years ago
Pierre Souchay	54b22c638d	config: allow running `consul agent -dev -ui-dir=some_path` (#7525) ... When run in with `-dev` in DevMode, it is not possible to replace the embeded UI with another one because `-dev` implies `-ui`. This commit allows this an slightly change the error message about Consul 0.7.0 which is very old and does not apply to current version anyway.	5 years ago
Daniel Nephin	475659a132	Remove name from NewTestAgent ... Using: git grep -l 'NewTestAgent(t, t.Name(),' | \ xargs sed -i -e 's/NewTestAgent(t, t.Name(),/NewTestAgent(t,/g'	5 years ago
Freddy	90576060bc	Add config entry for terminating gateways (#7545) ... This config entry will be used to configure terminating gateways. It accepts the name of the gateway and a list of services the gateway will represent. For each service users will be able to specify: its name, namespace, and additional options for TLS origination. Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Kyle Havlovitz	c911174327	Add config entry/state for Ingress Gateways (#7483) ... * Add Ingress gateway config entry and other relevant structs * Add api package tests for ingress gateways * Embed EnterpriseMeta into ingress service struct * Add namespace fields to api module and test consul config write decoding * Don't require a port for ingress gateways * Add snakeJSON and camelJSON cases in command test * Run Normalize on service's ent metadata Sadly cannot think of a way to test this in OSS. * Every protocol requires at least 1 service * Validate ingress protocols * Update agent/structs/config_entry_gateways.go Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Daniel Nephin	9d959907a4	Merge pull request #7485 from hashicorp/dnephin/do-not-skip-tests-on-ci ... ci: Make it harder to accidentally skip tests on CI, and doc why some are skipped	5 years ago
Daniel Nephin	ad7c78f134	Remove t.Name() from TestAgent.Name ... And re-add the name to the logger so that log messages from different agents in a single can be identified.	5 years ago
Daniel Nephin	231c99f7b4	Document Agent.LogOutput	5 years ago
Daniel Nephin	dd40a1535e	testing: reduce verbosity of output log ... Previously the log output included the test name twice and a long date format. The test output is already grouped by test, so adding the test name did not add any new information. The date and time are only useful to understand elapsed time, so using a short format should provide succident detail. Also fixed a bug in NewTestAgentWithFields where nil was returned instead of the test agent.	5 years ago
Daniel Nephin	1d90ecc31d	Remove unused token parameter	5 years ago
Daniel Nephin	ef68e404a5	A little less 'just'	5 years ago
Daniel Nephin	002fc85ef2	Remove unused customEDSClusterJSON	5 years ago
Matt Keeler	028654410c	Ensure server requirements checks are done against ALL known se… (#7491) ... Co-authored-by: Paul Banks <banks@banksco.de>	5 years ago
Matt Keeler	74a665afc3	Add information about which services are proxied to ui services… (#7417)	5 years ago
Daniel Nephin	b5c7d292e4	Merge pull request #7516 from hashicorp/dnephin/remove-unused-method ... agent: Remove unused method Encrypted from delegate interface	5 years ago
Daniel Nephin	bb8833a2d5	agent: Remove unused Encrypted from interface ... It appears to be unused. It looks like it has been around a while, I geuss at some point we stopped using this method.	5 years ago
Freddy	18d356899c	Enable CLI to register terminating gateways (#7500) ... * Enable CLI to register terminating gateways * Centralize gateway proxy configuration	5 years ago
Daniel Nephin	33c7894123	Merge pull request #7498 from hashicorp/dnephin/small-cleanup ... envoy: small cleanup in cmd and server	5 years ago
Alejandro Baez	bafa69bb69	Add PolicyReadByName for API (#6615)	5 years ago
Chris Piraino	136099d834	Fix flakey health check reload test (#7490) ... This test would occasionally fail because we checked for a status of "critical" initially. This races with the actual healthcheck being run and declared passing. We instead use a ttl health check so that we don't rely on timing at all.	5 years ago
Daniel Nephin	266bdf7465	agent: Remove xdsServer field ... The field is only referenced from a single method, it can be a local var	5 years ago
Daniel Nephin	326453eaa1	dns: Remove a few unused params	5 years ago
Daniel Nephin	61ec7aa5c9	ci: Run all connect/ca tests from the integration suite ... To reduce the chance of some tests not being run because it does not match the regex passed to '-run'. Also document why some tests are allowed to be skipped on CI.	5 years ago
Daniel Nephin	f4a35dfd84	ci: Do not skip tests because of missing binaries on CI ... If the CI environment is not correct for running tests the tests should fail, so that we don't accidentally stop running some tests because of a change to our CI environment. Also removed a duplicate delcaration from init. I believe one was overriding the other as they are both in the same package.	5 years ago
Kim Ngo	bef693df9c	agent/xds: Update mesh gateway to use service router timeout (#7444) ... * website/connect/proxy/envoy: specify timeout precedence for services behind mesh gateway	5 years ago
Matt Keeler	80db61193c	Fix ACL mode advertisement and detection (#7451) ... These changes are necessary to ensure advertisement happens correctly even when datacenters are connected via network areas in Consul enterprise. This also changes how we check if ACLs can be upgraded within the local datacenter. Previously we would iterate through all LAN members. Now we just use the ServerLookup type to iterate through all known servers in the DC.	5 years ago
Freddy	709932f088	Update MSP token and filtering (#7431)	5 years ago
Hans Hasselberg	7777891aa6	tls: remove old ciphers (#7282) ... Following advice from: https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices, this PR removes old ciphers.	5 years ago
R.B. Boyer	85a08bf8ed	server: strip local ACL tokens from RPCs during forwarding if crossing datacenters (#7419) ... Fixes #7414	5 years ago
Kyle Havlovitz	955ee64b95	Merge pull request #7373 from hashicorp/acl-segments-fix ... Add stub methods for ACL/segment bug fix from enterprise	5 years ago
R.B. Boyer	6adad71125	wan federation via mesh gateways (#6884) ... This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch: There are several distinct chunks of code that are affected: * new flags and config options for the server * retry join WAN is slightly different * retry join code is shared to discover primary mesh gateways from secondary datacenters * because retry join logic runs in the *agent* and the results of that operation for primary mesh gateways are needed in the *server* there are some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur at multiple layers of abstraction just to pass the data down to the right layer. * new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers * the function signature for RPC dialing picked up a new required field (the node name of the destination) * several new RPCs for manipulating a FederationState object: `FederationState:{Apply,Get,List,ListMeshGateways}` * 3 read-only internal APIs for debugging use to invoke those RPCs from curl * raft and fsm changes to persist these FederationStates * replication for FederationStates as they are canonically stored in the Primary and replicated to the Secondaries. * a special derivative of anti-entropy that runs in secondaries to snapshot their local mesh gateway `CheckServiceNodes` and sync them into their upstream FederationState in the primary (this works in conjunction with the replication to distribute addresses for all mesh gateways in all DCs to all other DCs) * a "gateway locator" convenience object to make use of this data to choose the addresses of gateways to use for any given RPC or gossip operation to a remote DC. This gets data from the "retry join" logic in the agent and also directly calls into the FSM. * RPC (`:8300`) on the server sniffs the first byte of a new connection to determine if it's actually doing native TLS. If so it checks the ALPN header for protocol determination (just like how the existing system uses the type-byte marker). * 2 new kinds of protocols are exclusively decoded via this native TLS mechanism: one for ferrying "packet" operations (udp-like) from the gossip layer and one for "stream" operations (tcp-like). The packet operations re-use sockets (using length-prefixing) to cut down on TLS re-negotiation overhead. * the server instances specially wrap the `memberlist.NetTransport` when running with gateway federation enabled (in a `wanfed.Transport`). The general gist is that if it tries to dial a node in the SAME datacenter (deduced by looking at the suffix of the node name) there is no change. If dialing a DIFFERENT datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh gateways to eventually end up in a server's :8300 port. * a new flag when launching a mesh gateway via `consul connect envoy` to indicate that the servers are to be exposed. This sets a special service meta when registering the gateway into the catalog. * `proxycfg/xds` notice this metadata blob to activate additional watches for the FederationState objects as well as the location of all of the consul servers in that datacenter. * `xds:` if the extra metadata is in place additional clusters are defined in a DC to bulk sink all traffic to another DC's gateways. For the current datacenter we listen on a wildcard name (`server.<dc>.consul`) that load balances all servers as well as one mini-cluster per node (`<node>.server.<dc>.consul`) * the `consul tls cert create` command got a new flag (`-node`) to help create an additional SAN in certs that can be used with this flavor of federation.	5 years ago
Matt Keeler	e3891db55b	Gather instance counts of aggregated services (#7415)	5 years ago
Pierre Souchay	864f7efffa	agent: configuration reload preserves check's statuses for services (#7345) ... This fixes issue #7318 Between versions 1.5.2 and 1.5.3, a regression has been introduced regarding health of services. A patch #6144 had been issued for HealthChecks of nodes, but not for healthchecks of services. What happened when a reload was: 1. save all healthcheck statuses 2. cleanup everything 3. add new services with healthchecks In step 3, the state of healthchecks was taken into account locally, so at step 3, but since we cleaned up at step 2, state was lost. This PR introduces the snap parameter, so step 3 can use information from step 1	5 years ago
Hans Hasselberg	c46e2ae59b	docs: add docs for kv_max_value_size (#7405) ... Apart from the added docs, the error messages are similar now and are pointing to the corresponding options. Fixes #6708.	5 years ago
Kim Ngo	a8f4123d37	agent/txn_endpoint: configure max txn request length (#7388) ... configure max transaction size separately from kv limit	5 years ago
Matt Keeler	7584dfe8c8	Fix session backwards incompatibility with 1.6.x and earlier.	5 years ago
John Cowen	e83fb1882c	Adds http_config.response_headers to the UI headers plus tests (#7369)	5 years ago
Pierre Souchay	2300e2d4ba	agent: take Prometheus MIME-type header into account (#7371) ... This will avoid adding format=prometheus in request and to parse more easily metrics using Prometheus. This commit follows https://github.com/hashicorp/consul/pull/6514 as the PR has been closed and extends it by accepting old Prometheus mime-type.	5 years ago
Kyle Havlovitz	7c57837908	Add stub methods for ACL/segment bug fix from enterprise	5 years ago
Hans Hasselberg	e05ac57e8f	tls: support tls 1.3 (#7325)	5 years ago
Matt Keeler	861f754dad	Properly detect no alt domain set (#7323)	5 years ago
Matt Keeler	4c9577678e	xDS Mesh Gateway Resolver Subset Fixes (#7294) ... * xDS Mesh Gateway Resolver Subset Fixes The first fix was that clusters were being generated for every service resolver subset regardless of there being any service instances of the associated service in that dc. The previous logic didn’t care at all but now it will omit generating those clusters unless we also have service instances that should be proxied. The second fix was to respect the DefaultSubset of a service resolver so that mesh-gateways would configure the endpoints of the unnamed subset cluster to only those endpoints matched by the default subsets filters. * Refactor the gateway endpoint generation to be a little easier to read	5 years ago
rerorero	2630a949f7	fix: Destroying a session that doesn't exist returns status cod… (#6905) ... fix #6840	5 years ago
Wim	3a2c865ff6	Fix high cpu usage with IPv6 recursor address. Closes #6120 (#6128)	5 years ago
Chris Piraino	47ff532735	Fixes envoy config when both RetryOn* values are set (#7280)	5 years ago
Lars Lehtonen	6bcd596539	agent/proxycfg: fix dropped error in state.initWatchesMeshGateway() (#7267)	5 years ago
Matt Keeler	b137060630	Allow the PolicyResolve and RoleResolve endpoints to process na… (#7296)	5 years ago
Hans Hasselberg	315d57bfb1	agent: sensible keyring error (#7272) ... Fixes #7231. Before an agent would always emit a warning when there is an encrypt key in the configuration and an existing keyring stored, which is happening on restart. Now it only emits that warning when the encrypt key from the configuration is not part of the keyring.	5 years ago
Hans Hasselberg	cb0f94487c	config: increase http_max_conns_per_client default to 200 (#7289)	5 years ago
R.B. Boyer	12876983cf	avoid 'panic: Log in goroutine after TestCacheGet_refreshAge has completed' (#7276)	5 years ago
R.B. Boyer	80b1165976	fix use of hclog logger (#7264)	5 years ago
Matt Keeler	f523469529	Merge branch 'master' of github.com:hashicorp/consul	5 years ago
hashicorp-ci	f0cac9260f	update bindata_assetfs.go	5 years ago
ShimmerGlass	68e0f6bf84	agent: add server raft.{last,applied}_index gauges (#6694) ... These metrics are useful for : * Tracking the rate of update to the db * Allow to have a rough idea of when an index originated	5 years ago
gaoxinge	216eb29d6b	tests: convert windows style path to posix style path to avoid hcl parsing error (#6351)	5 years ago
Matt Keeler	e231d62bc9	Make the config entry and leaf cert cache types ns aware (#7256)	5 years ago
Hans Hasselberg	6739fe6e83	connect: add validations around intermediate cert ttl (#7213)	5 years ago
R.B. Boyer	73ba5d9990	make the TestRPC_RPCMaxConnsPerClient test less flaky (#7255)	5 years ago
Sarah Christoff	6678c8898a	Fix flaky TestAutopilot_BootstrapExpect (#7242)	5 years ago
Kit Patella	55f19a9eb2	rpc: measure blocking queries (#7224) ... * agent: measure blocking queries * agent.rpc: update docs to mention we only record blocking queries * agent.rpc: make go fmt happy * agent.rpc: fix non-atomic read and decrement with bitwise xor of uint64 0 * agent.rpc: clarify review question * agent.rpc: today I learned that one must declare all variables before interacting with goto labels * Update agent/consul/server.go agent.rpc: more precise comment on `Server.queriesBlocking` Co-Authored-By: Paul Banks <banks@banksco.de> * Update website/source/docs/agent/telemetry.html.md agent.rpc: improve queries_blocking description Co-Authored-By: Paul Banks <banks@banksco.de> * agent.rpc: fix some bugs found in review * add a note about the updated counter behavior to telemetry.md * docs: add upgrade-specific note on consul.rpc.quer{y,ies_blocking} behavior Co-authored-by: Paul Banks <banks@banksco.de>	5 years ago
Akshay Ganeshen	8beb716414	feat: support sending body in HTTP checks (#6602)	5 years ago
Matt Keeler	4f21bbdb4e	OSS Changes for agent local state namespace testing (#7250)	5 years ago
Matt Keeler	d0cd092e3b	Catalog + Namespace OSS changes. (#7219) ... * Various Prepared Query + Namespace things * Last round of OSS changes for a namespaced catalog	5 years ago
R.B. Boyer	8c596953b0	agent: ensure that we always use the same settings for msgpack (#7245) ... We set RawToString=true so that []uint8 => string when decoding an interface{}. We set the MapType so that map[interface{}]interface{} decodes to map[string]interface{}. Add tests to ensure that this doesn't break existing usages. Fixes #7223	5 years ago
Freddy	01855d8579	Remove outdated TODO (#7244)	5 years ago
Matt Keeler	444517080b	Fix a bug with ACL enforcement of reads on namespaced config entries. (#7239)	5 years ago
Kit Patella	9a220f3010	agent/consul server: fix LeaderTest_ChangeNodeID (#7236) ... * fix LeaderTest_ChangeNodeID to use StatusLeft and add waitForAnyLANLeave * unextract the waitFor... fn, simplify, and provide a more descriptive error	5 years ago
Matt Keeler	9e5fd7f925	OSS Changes for various config entry namespacing bugs (#7226)	5 years ago
Hans Hasselberg	6a18f01b42	agent: ensure node info sync and full sync. (#7189) ... This fixes #7020. There are two problems this PR solves: * if the node info changes it is highly likely to get service and check registration permission errors unless those service tokens have node:write. Hopefully services you register don’t have this permission. * the timer for a full sync gets reset for every partial sync which means that many partial syncs are preventing a full sync from happening Instead of syncing node info last, after services and checks, and possibly saving one RPC because it is included in every service sync, I am syncing node info first. It is only ever going to be a single RPC that we are only doing when node info has changed. This way we are guaranteed to sync node info even when something goes wrong with services or checks which is more likely because there are more syncs happening for them.	5 years ago
R.B. Boyer	0ecb4538c1	agent: differentiate wan vs lan loggers in memberlist and serf (#7205) ... This should be a helpful change until memberlist and serf can be properly switched to native hclog.	5 years ago
Matt Keeler	dceb107325	Fix disco chain graph validation for namespaces (#7217) ... Previously this happened to be validating only the chains in the default namespace. Now it will validate all chains in all namespaces when the global proxy-defaults is changed.	5 years ago
Matt Keeler	228da48f5d	Minor Non-Functional Updates (#7215) ... * Cleanup the discovery chain compilation route handling Nothing functionally should be different here. The real difference is that when creating new targets or handling route destinations we use the router config entries name and namespace instead of that of the top level request. Today they SHOULD always be the same but that may not always be the case. This hopefully also makes it easier to understand how the router entries are handled. * Refactor a small bit of the service manager tests in oss We used to use the stringHash function to compute part of the filename where things would get persisted to. This has been changed in the core code to calling the StringHash method on the ServiceID type. It just so happens that the new method will output the same value for anything in the default namespace (by design actually). However, logically this filename computation in the test should do the same thing as the core code itself so I updated it here. Also of note is that newer enterprise-only tests for the service manager cannot use the old stringHash function at all because it will produce incorrect results for non-default namespaces.	5 years ago
Freddy	cb77fc6d01	Add managed service provider token (#7218) ... Stubs for enterprise-only ACL token to be used by managed service providers.	5 years ago
Hans Hasselberg	f6ec8ed92b	agent: increase watchLimit to 8192. (#7200) ... The previous value was too conservative and users with many instances were having problems because of it. This change increases the limit to 8192 which reportedly fixed most of the issues with that. Related: #4984, #4986, #5050.	5 years ago
Matt Keeler	dfb0177dbc	Testing updates to support namespaced testing of the agent/xds… (#7185) ... * Various testing updates to support namespaced testing of the agent/xds package * agent/proxycfg package updates to support better namespace testing	5 years ago
Davor Kapsa	3cb4def563	auto_encrypt: check previously ignored error (#6604)	5 years ago
hashicorp-ci	1fcf4bfc10	update bindata_assetfs.go	5 years ago
Hans Hasselberg	5531678e9e	Security fixes (#7182) ... * Mitigate HTTP/RPC Services Allow Unbounded Resource Usage Fixes #7159. Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: Paul Banks <banks@banksco.de>	5 years ago
Matt Keeler	d5f9268222	ACL enforcement for the agent/health/services endpoints (#7191) ... ACL enforcement for the agent/health/services endpoints	5 years ago
R.B. Boyer	cf29bd4dcf	cli: improve the file safety of 'consul tls' subcommands (#7186) ... - also fixing the signature of file.WriteAtomicWithPerms	5 years ago
Matt Keeler	d8c0be2c84	agent: add ACL enforcement to the v1/agent/health/service/* endpoints ... This adds acl enforcement to the two endpoints that were missing it. Note that in the case of getting a services health by its id, we still must first lookup the service so we still "leak" information about a service with that ID existing. There isn't really a way around it though as ACLs are meant to check service names.	5 years ago
Matt Keeler	6855a778c2	Updates to the Txn API for namespaces (#7172) ... * Updates to the Txn API for namespaces * Update agent/consul/txn_endpoint.go Co-Authored-By: R.B. Boyer <rb@hashicorp.com> Co-authored-by: R.B. Boyer <public@richardboyer.net>	5 years ago
Matt Keeler	cf27dff62f	Add some better waits to prevent CA is nil test flakes (#7171)	5 years ago
Matt Keeler	0be862fe46	Small refactoring to move meta parsing into the switch statement (#7170)	5 years ago
Matt Keeler	bfc03ec587	Fix a couple bugs regarding intentions with namespaces (#7169)	5 years ago
Matt Keeler	61d8778210	Sync some feature flag support from enterprise (#7167)	5 years ago
R.B. Boyer	d78b5008ce	various tweaks on top of the hclog work (#7165)	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130) ... * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Matt Keeler	848938ad48	Output proper HTTP status codes for Txn requests that are too large (#7157)	5 years ago
Kit Patella	0d336edb65	Add accessorID of token when ops are denied by ACL system (#7117) ... * agent: add and edit doc comments * agent: add ACL token accessorID to debugging traces * agent: polish acl debugging * agent: minor fix + string fmt over value interp * agent: undo export & fix logging field names * agent: remove note and migrate up to code review * Update agent/consul/acl.go Co-Authored-By: Matt Keeler <mkeeler@users.noreply.github.com> * agent: incorporate review feedback * Update agent/acl.go Co-Authored-By: R.B. Boyer <public@richardboyer.net> Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: R.B. Boyer <public@richardboyer.net>	5 years ago
Anthony Scalisi	beb928f8de	fix spelling errors (#7135)	5 years ago
hashicorp-ci	1194d2fbb7	update bindata_assetfs.go	5 years ago
Matt Keeler	c09693e545	Updates to Config Entries and Connect for Namespaces (#7116)	5 years ago
Matt Keeler	bbc2eb1951	Add the v1/catalog/node-services/:node endpoint (#7115) ... The backing RPC already existed but the endpoint will be useful for other service syncing processes such as consul-k8s as this endpoint can return all services registered with a node regardless of namespacing.	5 years ago