2150 Commits (b5b9c8d953cd3c79c6b795946839f4cf5012f507)

Author	SHA1	Message	Date
Chris Piraino	735337b170	Append port number to ingress host domain (#8190) ... A port can be sent in the Host header as defined in the HTTP RFC, so we take any hosts that we want to match traffic to and also add another host with the listener port added. Also fix an issue with envoy integration tests not running the case-ingress-gateway-tls test.	4 years ago
Daniel Nephin	a7f69b615a	Merge pull request #8215 from hashicorp/dnephin/support-not-modified-response-server ... agent/consul: Add support for NotModified to two endpoints	4 years ago
Pierre Souchay	20d1ea7d2d	Upgrade go-connlimit to v0.3.0 / return http 429 on too many connections (#8221) ... Fixes #7527 I want to highlight this and explain what I think the implications are and make sure we are aware: * `HTTPConnStateFunc` closes the connection when it is beyond the limit. `Close` does not block. * `HTTPConnStateFuncWithDefault429Handler(10 * time.Millisecond)` blocks until the following is done (worst case): 1) `conn.SetDeadline(10*time.Millisecond)` so that 2) `conn.Write(429error)` is guaranteed to timeout after 10ms, so that the http 429 can be written and 3) `conn.Close` can happen The implication of this change is that accepting any new connection is worst case delayed by 10ms. But only after a client reached the limit already.	4 years ago
Daniel Nephin	5d36f98710	agent/consul: Add support for NotModified to two endpoints ... A query made with AllowNotModifiedResponse and a MinIndex, where the result has the same Index as MinIndex, will return an empty response with QueryMeta.NotModified set to true. Co-authored-by: Pierre Souchay <pierresouchay@users.noreply.github.com>	4 years ago
Matt Keeler	f8e8f48125	Merge pull request #8211 from hashicorp/bugfix/auto-encrypt-various	4 years ago
Yury Evtikhov	10361dd210	DNS: add IsErrQueryNotFound function for easier error evaluation	4 years ago
Yury Evtikhov	8d18422f19	DNS: fix agent returning SERVFAIL where NXDOMAIN should be returned	4 years ago
Yury Evtikhov	3b4ddaaab5	DNS: add test to verify NXDOMAIN is returned when a non-existent domain is queried over RPC	4 years ago
Matt Keeler	6e7acfa618	Add an AutoEncrypt “integration” test ... Also fix a bug where Consul could segfault if TLS was enabled but no client certificate was provided. How no one has reported this as a problem I am not sure.	4 years ago
Matt Keeler	2ddcba00c6	Overwrite agent leaf cert trust domain on the servers	4 years ago
Matt Keeler	19040f1166	Store the Connect CA rate limiter on the server ... This fixes a bug where auto_encrypt was operating without utilizing a common rate limiter.	4 years ago
Matt Keeler	a5a9560bbd	Initialize the agent leaf cert cache result with a state to prevent unnecessary second certificate signing	4 years ago
Matt Keeler	39b567a55a	Fix auto_encrypt IP/DNS SANs ... The initial auto encrypt CSR wasn’t containing the user supplied IP and DNS SANs. This fixes that. Also We were configuring a default :: IP SAN. This should be ::1 instead and was fixed.	4 years ago
Matt Keeler	85fd8c552f	Merge pull request #8193 from hashicorp/feature/auto-config/suppress-config-warnings	4 years ago
R.B. Boyer	462f0f37ed	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194) ... Highlights: - add new endpoint to query for intentions by exact match - using this endpoint from the CLI instead of the dump+filter approach - enforcing that OSS can only read/write intentions with a SourceNS or DestinationNS field of "default". - preexisting OSS intentions with now-invalid namespace fields will delete those intentions on initial election or for wildcard namespaces an attempt will be made to downgrade them to "default" unless one exists. - also allow the '-namespace' CLI arg on all of the intention subcommands - update lots of docs	4 years ago
Matt Keeler	be576c9737	Use the DNS and IP SANs from the auto config stanza when set	4 years ago
Matt Keeler	e8b39dd255	Overhaul the auto-config translation ... This fixes some issues around spurious warnings about using enterprise configuration in OSS.	4 years ago
Freddy	10d6e9c458	Split up unused key validation for oss/ent (#8189) ... Split up unused key validation in config entry decode for oss/ent. This is needed so that we can return an informative error in OSS if namespaces are provided.	4 years ago
Daniel Nephin	a891ee8428	Merge pull request #8176 from hashicorp/dnephin/add-linter-unparam-1 ... lint: add unparam linter and fix some of the issues	4 years ago
Matt Keeler	7041f69892	Merge pull request #8184 from hashicorp/bugfix/goroutine-leaks	4 years ago
Chris Piraino	df48db0abd	Merge pull request #7932 from hashicorp/ingress/internal-ui-endpoint-multiple-ports ... Update gateway-services-nodes API endpoint to allow multiple addresses	4 years ago
Chris Piraino	f213d3592a	remove obsolete comments about test parallelization	4 years ago
Chris Piraino	b3db907bdf	Update gateway-services-nodes API endpoint to allow multiple addresses ... Previously, we were only returning a single ListenerPort for a single service. However, we actually allow a single service to be serviced over multiple ports, as well as allow users to define what hostnames they expect their services to be contacted over. When no hosts are defined, we return the default ingress domain for any configured DNS domain. To show this in the UI, we modify the gateway-services-nodes API to return a GatewayConfig.Addresses field, which is a list of addresses over which the specific service can be contacted.	4 years ago
Matt Keeler	e9835610f3	Add a test for go routine leaks ... This is in its own separate package so that it will be a separate test binary that runs thus isolating the go runtime from other tests and allowing accurate go routine leak checking. This test would ideally use goleak.VerifyTestMain but that will fail 100% of the time due to some architectural things (blocking queries and net/rpc uncancellability). This test is not comprehensive. We should enable/exercise more features and more cluster configurations. However its a start.	4 years ago
Matt Keeler	29d0cfdd7d	Fix go routine leak in auto encrypt ca roots tracking	4 years ago
Matt Keeler	25a4f3c83b	Allow cancelling blocking queries in response to shutting down.	4 years ago
Daniel Nephin	0279bf6fe5	Update TestAgent_GetCoordinate ... The old test case was a very specific regresion test for a case that is no longer possible. Replaced with a new test that checks the default coordinate is returned.	4 years ago
Daniel Nephin	f65e21e6dc	Remove unused return values	4 years ago
Daniel Nephin	010a609912	Fix a bunch of unparam lint issues	4 years ago
Matt Keeler	15e7b3940c	Ensure that retryLoopBackoff can be cancelled ... We needed to pass a cancellable context into the limiter.Wait instead of context.Background. So I made the func take a context instead of a chan as most places were just passing through a Done chan from a context anyways. Fix go routine leak in the gateway locator	4 years ago
Matt Keeler	e2cfa93f02	Don’t leak metrics go routines in tests (#8182)	4 years ago
gitforbit	808f632346	agent-http: cleanup: return nil instead of err (#8043) ... Since err is already checked, it should return `nil`	4 years ago
R.B. Boyer	c63c994b04	connect: upgrade github.com/envoyproxy/go-control-plane to v0.9.5 (#8165)	4 years ago
freddygv	c791fbc79c	Update namespaces subject-verb agreement	4 years ago
freddygv	044d027ff8	Remove break	4 years ago
freddygv	70810b0602	Let users know namespaces are ent only in config entry decode	4 years ago
Pierre Souchay	35d852fd9a	Returns DNS Error NSDOMAIN when DC does not exists (#8103) ... This will allow to increase cache value when DC is not valid (aka return SOA to avoid too many consecutive requests) and will distinguish DC being temporarily not available from DC not existing. Implements https://github.com/hashicorp/consul/issues/8102	5 years ago
Matt Keeler	4a5b352c18	Require enabling TLS to enable Auto Config (#8159) ... On the servers they must have a certificate. On the clients they just have to set verify_outgoing to true to attempt TLS connections for RPCs. Eventually we may relax these restrictions but right now all of the settings we push down (acl tokens, acl related settings, certificates, gossip key) are sensitive and shouldn’t be transmitted over an unencrypted connection. Our guides and docs should recoommend verify_server_hostname on the clients as well. Another reason to do this is weird things happen when making an insecure RPC when TLS is not enabled. Basically it tries TLS anyways. We should probably fix that to make it clearer what is going on.	5 years ago
Freddy	5baa7b1b04	Always return a gateway cluster (#8158)	5 years ago
Matt Keeler	d6e05482ab	Allow cancelling startup when performing auto-config (#8157) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	5 years ago
Daniel Nephin	4f17350928	Merge pull request #8147 from hashicorp/dnephin/remove-private-ip-2 ... Remove some dead code from agent/consul/util.go	5 years ago
Matt Keeler	b0fcf86140	Change auto config authorizer to allow for future extension ... The envisioned changes would allow extra settings to enable dynamically defined auth methods to be used instead of or in addition to the statically defined one in the configuration.	5 years ago
Daniel Nephin	b0ba546a1f	Remove bytesToUint64 from agent/consul	5 years ago
Daniel Nephin	a00f007c5e	Remove unused private IP code from agent/consul	5 years ago
Matt Keeler	3dbbd2d37d	Implement Client Agent Auto Config ... There are a couple of things in here. First, just like auto encrypt, any Cluster.AutoConfig RPC will implicitly use the less secure RPC mechanism. This drastically modifies how the Consul Agent starts up and moves most of the responsibilities (other than signal handling) from the cli command and into the Agent.	5 years ago
Matt Keeler	8b7d669a27	Allow the Agent its its child Client/Server to share a connection pool ... This is needed so that we can make an AutoConfig RPC at the Agent level prior to creating the Client/Server.	5 years ago
Matt Keeler	51c3a605ad	Merge pull request #8035 from hashicorp/feature/auto-config/server-rpc	5 years ago
Chris Piraino	79a862d019	Remove ACLEnforceVersion8 from tests (#8138) ... The field had been deprecated for a while and was recently removed, however a PR which added these tests prior to removal was merged.	5 years ago
Daniel Nephin	692a4a8fc8	Merge pull request #7762 from hashicorp/dnephin/warn-on-unknown-service-file ... config: warn if a config file is being skipped because of its file extension	5 years ago
Daniel Nephin	be29d6bf75	config: warn when a config file is skipped ... All commands which read config (agent, services, and validate) will now print warnings when one of the config files is skipped because it did not match an expected format. Also ensures that config validate prints all warnings.	5 years ago