126 Commits (b552f52adfa07d95776680b26ab3299da8ea5583)

Author	SHA1	Message	Date
Chris S. Kim	7d1899d907	Fix integration test with updated file perms (#11916)	3 years ago
freddygv	5c1f7aa372	Allow cross-partition references in disco chain ... * Add partition fields to targets like service route destinations * Update validation to prevent cross-DC + cross-partition references * Handle partitions when reading config entries for disco chain * Encode partition in compiled targets	3 years ago
freddygv	129d54d060	Fix integ test	3 years ago
R.B. Boyer	1e02460bd1	re-run gofmt on 1.17 (#11579) ... This should let freshly recompiled golangci-lint binaries using Go 1.17 pass 'make lint'	3 years ago
freddygv	cc19f09f92	Add cross-partition integration test	3 years ago
freddygv	d6c26ea598	Bump retry time for cross-DC RPC ... The secondary DC now takes longer to populate the MGW snapshot because it needs to wait for the secondary CA to be initialized before it can receive roots and generate xDS config. Previously MGWs could receive empty roots before the CA was initialized. This wasn't necessarily a problem since the cluster ID in the trust domain isn't verified.	3 years ago
Evan Culver	61be9371f5	connect: Remove support for Envoy 1.16 (#11354)	3 years ago
Evan Culver	bec08f4ec3	connect: Add support for Envoy 1.20 (#11277)	3 years ago
R.B. Boyer	c5b7e2a759	test: pin the version of bats to one that works on CircleCI (#11401)	3 years ago
R.B. Boyer	3b6eeced50	test: remove some envoy integ test warnings (#11369) ... We launch one container as part of the test with --pid=host but apparently within that container it launches a copy of "tini" as a process supervisor that prefers to be PID 1. Because it's not PID 1 it logs a warning message about this to the envoy integration test logs that can lead to thinking somehow that a test failure is related when in fact it's completely unrelated. Adding this environment variable avoids the warning.	3 years ago
Evan Culver	585d9363ed	Merge branch 'main' into eculver/envoy-1.19.1	3 years ago
Paul Banks	e0efb420f7	Add Envoy integration test for split-route SDS case	3 years ago
Paul Banks	ab27214a10	Minor improvements to SDS server from review	3 years ago
Paul Banks	2b755d7b3f	Allow skipping v2 compat tests for SDS as it's only the SDS server integration that doesn't support v2	3 years ago
Paul Banks	e01c3585a5	Fix integration tests in CI - serve SDS certs from the Docker image not a mounted path	3 years ago
Paul Banks	843079f33a	Fix integration test for older Envoy versions	3 years ago
Paul Banks	cd8ad007fe	Add basic integration test for Envoy ingress with SDS	3 years ago
Evan Culver	7605dff46e	add envoy 1.19.1	3 years ago
Paul Banks	81eb706906	Add Envoy integration test to show Header manip can interpolate Envoy variables	3 years ago
Paul Banks	1b9632531a	Integration tests for all new header manip features	3 years ago
Freddy	8d83d27674	connect: update envoy supported versions to latest patch release ... (#10961) Relevant advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h	3 years ago
Kyle Havlovitz	073b6c8411	oss: Rename default partition	3 years ago
Matt Keeler	caafc02449	hcs-1936: Prepare for adding license auto-retrieval to auto-config in enterprise	4 years ago
R.B. Boyer	3b50a55533	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231)	4 years ago
Daniel Nephin	426565b68c	fix failing integration tests ... The new IDs include a leading slash for the partition ID section	4 years ago
R.B. Boyer	abc1dc0fe9	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101) ... The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
R.B. Boyer	71d45a3460	Support Incremental xDS mode (#9855) ... This adds support for the Incremental xDS protocol when using xDS v3. This is best reviewed commit-by-commit and will not be squashed when merged. Union of all commit messages follows to give an overarching summary: xds: exclusively support incremental xDS when using xDS v3 Attempts to use SoTW via v3 will fail, much like attempts to use incremental via v2 will fail. Work around a strange older envoy behavior involving empty CDS responses over incremental xDS. xds: various cleanups and refactors that don't strictly concern the addition of incremental xDS support Dissolve the connectionInfo struct in favor of per-connection ResourceGenerators instead. Do a better job of ensuring the xds code uses a well configured logger that accurately describes the connected client. xds: pull out checkStreamACLs method in advance of a later commit xds: rewrite SoTW xDS protocol tests to use protobufs rather than hand-rolled json strings In the test we very lightly reuse some of the more boring protobuf construction helper code that is also technically under test. The important thing of the protocol tests is testing the protocol. The actual inputs and outputs are largely already handled by the xds golden output tests now so these protocol tests don't have to do double-duty. This also updates the SoTW protocol test to exclusively use xDS v2 which is the only variant of SoTW that will be supported in Consul 1.10. xds: default xds.Server.AuthCheckFrequency at use-time instead of construction-time	4 years ago
R.B. Boyer	52205ac201	test: switch envoy integration tests to use pkill instead of ps+grep+awk+kill (#10097)	4 years ago
Freddy	a11ea6254e	Check for optionally prepended namespace in upstream assertion (#10049)	4 years ago
Yong Wen Chua	516335e415	Update assertion to not check for port	4 years ago
Yong Wen Chua	409768d6e5	Merge branch 'master' of github.com:hashicorp/consul into tg-rewrite	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	4 years ago
Yong Wen Chua	ec8fecbf61	Add integration test check	4 years ago
R.B. Boyer	3b6ffc447b	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	4 years ago
R.B. Boyer	39effd620c	xds: only try to create an ipv6 expose checks listener if ipv6 is supported by the kernel (#9765) ... Fixes #9311 This only fails if the kernel has ipv6 hard-disabled. It is not sufficient to merely not provide an ipv6 address for a network interface.	4 years ago
Alvin Huang	bf5b76851a	remove reference to docker/ path for old docker mirror (#9783)	4 years ago
Michele Degges	fee295b685	Remove jfrog references (#9782)	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737)	4 years ago
Daniel Nephin	79284b41ea	Pin alpine/socat image to a version. ... To fix failing integration tests. The latest version (`1.7.4.0-r0`) appears to not be catting all the bytes, so the expected metrics are missing in the output.	4 years ago
Freddy	fe728855ed	Add DC and NS support for Envoy metrics (#9207) ... This PR updates the tags that we generate for Envoy stats. Several of these come with breaking changes, since we can't keep two stats prefixes for a filter.	4 years ago
R.B. Boyer	5afd04897c	test: use direct service registration in envoy integration tests (#9138) ... This has the biggest impact on enterprise test cases that use namespaced registrations, which prior to this change sometimes failed the initial registration because the namespace was not yet created.	4 years ago
R.B. Boyer	8baf158ea8	Revert "Add namespace support for metrics (OSS) (#9117)" (#9124) ... This reverts commit 06b3b017d3.	4 years ago
Freddy	06b3b017d3	Add namespace support for metrics (OSS) (#9117)	4 years ago
R.B. Boyer	44bd8bd2ae	use the docker proxy for more envoy integration test containers (#9085)	4 years ago
R.B. Boyer	957293d884	wait_for_namespace should take two args (#9086)	4 years ago
Alvin Huang	ae6185a554	use hashicorp docker mirror in envoy helper (#9080)	4 years ago
R.B. Boyer	d7b37e3c6e	fix envoy integ test wait_for_namespace to actually work on CI (#9082)	4 years ago
Alvin Huang	ea88956c9c	use hashicorp docker mirror to prevent rate limit (#9070)	4 years ago
R.B. Boyer	a66c4591d7	agent: introduce path allow list for requests going through the metrics proxy (#9059) ... Added a new option `ui_config.metrics_proxy.path_allowlist`. This defaults to `["/api/v1/query", "/api/v1/query_range"]` when the metrics provider is set to `prometheus`. Requests that do not use one of the allow-listed paths (via exact match) get a 403 Forbidden response instead.	4 years ago
R.B. Boyer	b724e096c2	add namespace waiting function to envoy integration tests (#9051)	4 years ago